diff --git a/src/fs/object_container_store.c b/src/fs/object_container_store.c
index e22bee9..7e09a1b 100644
--- a/src/fs/object_container_store.c
+++ b/src/fs/object_container_store.c
@@ -357,7 +357,7 @@ static void file_object_container_rollback(const uint16_t *record_fids, size_t r
     flash_commit();
 }
 
-int file_object_container_update(const file_object_container_layout_t *layout, uint32_t container_id, const file_object_container_write_t *writes, size_t write_count, const file_object_container_crypto_t *primary, const file_object_container_crypto_t *legacy) {
+static int file_object_container_update_internal(const file_object_container_layout_t *layout, uint32_t container_id, const file_object_container_write_t *writes, size_t write_count, const file_object_container_crypto_t *primary, const file_object_container_crypto_t *legacy, bool validate_records) {
     if (!file_object_container_layout_valid(layout) || !file_object_container_crypto_valid(primary) || !writes || write_count == 0 || write_count > FILE_OBJECT_MANIFEST_MAX_OBJECTS) {
         return PICOKEYS_ERR_NULL_PARAM;
     }
@@ -372,7 +372,7 @@ int file_object_container_update(const file_object_container_layout_t *layout, u
         state.current_slot = FILE_OBJECT_CONTAINER_INVALID_SLOT;
         state.crypto = *primary;
     }
-    else {
+    else if (validate_records) {
         r = file_object_container_select_valid(layout, container_id, &state);
         if (r != PICOKEYS_OK) {
             return r;
@@ -488,6 +488,14 @@ int file_object_container_update(const file_object_container_layout_t *layout, u
     return PICOKEYS_OK;
 }
 
+int file_object_container_update(const file_object_container_layout_t *layout, uint32_t container_id, const file_object_container_write_t *writes, size_t write_count, const file_object_container_crypto_t *primary, const file_object_container_crypto_t *legacy) {
+    return file_object_container_update_internal(layout, container_id, writes, write_count, primary, legacy, true);
+}
+
+int file_object_container_update_without_record_validation(const file_object_container_layout_t *layout, uint32_t container_id, const file_object_container_write_t *writes, size_t write_count, const file_object_container_crypto_t *primary, const file_object_container_crypto_t *legacy) {
+    return file_object_container_update_internal(layout, container_id, writes, write_count, primary, legacy, false);
+}
+
 int file_object_container_remove(const file_object_container_layout_t *layout, uint32_t container_id, uint16_t object_type, uint16_t object_tag, const file_object_container_crypto_t *primary, const file_object_container_crypto_t *legacy) {
     if (!file_object_container_layout_valid(layout) || !file_object_container_crypto_valid(primary)) {
         return PICOKEYS_ERR_NULL_PARAM;
diff --git a/src/fs/object_container_store.h b/src/fs/object_container_store.h
index b5e472d..dcfdcc4 100644
--- a/src/fs/object_container_store.h
+++ b/src/fs/object_container_store.h
@@ -86,6 +86,7 @@ bool file_object_container_references(const file_object_manifest_t *manifest, ui
 int file_object_container_object_size(const file_object_container_layout_t *layout, uint32_t container_id, uint16_t object_type, uint16_t object_tag, const file_object_container_crypto_t *primary, const file_object_container_crypto_t *legacy, file_object_container_access_t access, void *access_ctx, uint32_t *object_size);
 int file_object_container_read(const file_object_container_layout_t *layout, uint32_t container_id, uint16_t object_type, uint16_t object_tag, const file_object_container_crypto_t *primary, const file_object_container_crypto_t *legacy, file_object_container_access_t access, void *access_ctx, byte_buffer_t *data);
 int file_object_container_update(const file_object_container_layout_t *layout, uint32_t container_id, const file_object_container_write_t *writes, size_t write_count, const file_object_container_crypto_t *primary, const file_object_container_crypto_t *legacy);
+int file_object_container_update_without_record_validation(const file_object_container_layout_t *layout, uint32_t container_id, const file_object_container_write_t *writes, size_t write_count, const file_object_container_crypto_t *primary, const file_object_container_crypto_t *legacy);
 int file_object_container_remove(const file_object_container_layout_t *layout, uint32_t container_id, uint16_t object_type, uint16_t object_tag, const file_object_container_crypto_t *primary, const file_object_container_crypto_t *legacy);
 int file_object_container_delete(const file_object_container_layout_t *layout, uint32_t container_id, const file_object_container_crypto_t *primary, const file_object_container_crypto_t *legacy);
 
diff --git a/src/fs/vault_container.c b/src/fs/vault_container.c
index ba93987..b9a7cda 100644
--- a/src/fs/vault_container.c
+++ b/src/fs/vault_container.c
@@ -271,7 +271,7 @@ static int vault_update(const file_object_container_write_t *writes, size_t writ
     if (!vault_state_valid() || !writes || write_count == 0) {
         return PICOKEYS_ERR_NULL_PARAM;
     }
-    return file_object_container_update(vault_state.layout, PICOKEYS_VAULT_CONTAINER_ID, writes, write_count, &vault_state.primary, vault_state.has_legacy ? &vault_state.legacy : NULL);
+    return file_object_container_update_without_record_validation(vault_state.layout, PICOKEYS_VAULT_CONTAINER_ID, writes, write_count, &vault_state.primary, vault_state.has_legacy ? &vault_state.legacy : NULL);
 }
 
 bool picokeys_vault_wrap_available(uint8_t app_id) {
diff --git a/src/vault.c b/src/vault.c
index 82caaf4..2e4cabe 100644
--- a/src/vault.c
+++ b/src/vault.c
@@ -424,7 +424,7 @@ int picokeys_vault_enrollment_decode(const uint8_t *packet, size_t packet_len, u
         mbedtls_gcm_init(&gcm);
         ret = mbedtls_gcm_setkey(&gcm, MBEDTLS_CIPHER_ID_AES, session_key, 256);
         if (ret == 0) {
-            ret = mbedtls_gcm_auth_decrypt(&gcm, plain_len, packet + encrypted_offset, 12u, info, sizeof(info), enrollment_tag, sizeof(enrollment_tag), enrollment_cipher, enrollment_plain);
+            ret = mbedtls_gcm_auth_decrypt(&gcm, plain_len, packet + encrypted_offset, 12u, info, sizeof(info), enrollment_tag, 16u, enrollment_cipher, enrollment_plain);
         }
         mbedtls_gcm_free(&gcm);
     }