diff --git a/packages/node_modules/@node-red/runtime/lib/flows/index.js b/packages/node_modules/@node-red/runtime/lib/flows/index.js
index 55d5b2dc5..fbf339d03 100644
--- a/packages/node_modules/@node-red/runtime/lib/flows/index.js
+++ b/packages/node_modules/@node-red/runtime/lib/flows/index.js
@@ -160,16 +160,22 @@ function setFlows(_config,_credentials,type,muteLog,forceStart,user) {
         var credsDirty;
 
         if (_credentials) {
-            credentials.clean(config);
-            // A full set of credentials have been provided. Use those instead
-            let credentialSavePromises = [];
-            for (let id in _credentials) {
-                if (_credentials.hasOwnProperty(id)) {
-                    credentialSavePromises.push(credentials.add(id,_credentials[id]));
+            if (_credentials['$']) {
+                // this is a set of encrypted credentials - pass to load to decrypt
+                // the complete set
+                configSavePromise = credentials.load(_credentials);
+            } else {
+                credentials.clean(config);
+                // A full set of credentials have been provided. Use those instead
+                let credentialSavePromises = [];
+                for (let id in _credentials) {
+                    if (_credentials.hasOwnProperty(id)) {
+                        credentialSavePromises.push(credentials.add(id,_credentials[id]));
+                    }
                 }
+                configSavePromise = Promise.all(credentialSavePromises);
+                credsDirty = true;
             }
-            configSavePromise = Promise.all(credentialSavePromises);
-            credsDirty = true;
         } else {
             // Allow the credential store to remove anything no longer needed
             credentials.clean(config);
diff --git a/test/unit/@node-red/runtime/lib/flows/index_spec.js b/test/unit/@node-red/runtime/lib/flows/index_spec.js
index 2e645df0d..7a384d9c8 100644
--- a/test/unit/@node-red/runtime/lib/flows/index_spec.js
+++ b/test/unit/@node-red/runtime/lib/flows/index_spec.js
@@ -33,6 +33,7 @@ describe('flows/index', function() {
     var eventsOn;
     var credentialsClean;
     var credentialsLoad;
+    var credentialsAdd;
 
     var flowCreate;
     var getType;
@@ -80,6 +81,7 @@ describe('flows/index', function() {
             }
             return Promise.resolve();
         });
+        credentialsAdd = sinon.stub(credentials,"add", async function(id, conf){})
         flowCreate = sinon.stub(Flow,"create",function(parent, global, flow) {
             var id;
             if (typeof flow === 'undefined') {
@@ -117,6 +119,7 @@ describe('flows/index', function() {
         eventsOn.restore();
         credentialsClean.restore();
         credentialsLoad.restore();
+        credentialsAdd.restore();
         flowCreate.restore();
 
         flows.stopFlows().then(done);
@@ -196,9 +199,10 @@ describe('flows/index', function() {
 
             flows.init({log:mockLog, settings:{},storage:storage});
             flows.setFlows(originalConfig,credentials).then(function() {
-                credentialsClean.called.should.be.false();
-                credentialsLoad.called.should.be.true();
-                credentialsLoad.lastCall.args[0].should.eql(credentials);
+                credentialsClean.called.should.be.true();
+                credentialsAdd.called.should.be.true();
+                credentialsAdd.lastCall.args[0].should.eql("t1-1");
+                credentialsAdd.lastCall.args[1].should.eql({"a":1});
                 flows.getFlows().flows.should.eql(originalConfig);
                 done();
             });