diff --git a/backend/src/handlers/profile_share.rs b/backend/src/handlers/profile_share.rs
index e2f4338..3895fb1 100644
--- a/backend/src/handlers/profile_share.rs
+++ b/backend/src/handlers/profile_share.rs
@@ -613,7 +613,10 @@ pub async fn rekey_profile(
     }
 
     // 3. Rotate the owner share (store the new account-wrapped profile DEK).
-    let updated = match profiles
+    // update_wrapped_dek uses find_one_and_update, which returns the PRE-image
+    // by default — so we don't read the new values back from it; we echo the
+    // request values (exactly what was stored) in the response below.
+    match profiles
         .update_wrapped_dek(
             &profile_id,
             &owner,
@@ -622,7 +625,7 @@ pub async fn rekey_profile(
         )
         .await
     {
-        Ok(Some(p)) => p,
+        Ok(Some(_)) => {}
         Ok(None) => {
             return Err((
                 StatusCode::NOT_FOUND,
@@ -636,7 +639,7 @@ pub async fn rekey_profile(
                 Json(serde_json::json!({ "error": "database error" })),
             ));
         }
-    };
+    }
 
     // 4. Upsert each submitted recipient envelope (fresh ECDH-wrapped DEK +
     //    ephemeral pubkey, replacing the old envelope). Preserve the original
@@ -695,8 +698,10 @@ pub async fn rekey_profile(
         StatusCode::OK,
         Json(RekeyResponse {
             profile_id,
-            wrapped_profile_dek: updated.wrapped_profile_dek,
-            wrapped_profile_dek_iv: updated.wrapped_profile_dek_iv,
+            // Echo the request values (exactly what was stored). Avoids the
+            // find_one_and_update pre-image gotcha.
+            wrapped_profile_dek: req.new_wrapped_profile_dek,
+            wrapped_profile_dek_iv: req.new_wrapped_profile_dek_iv,
             retained_recipient_user_ids: keep,
         }),
     ))