diff --git a/CHANGELOG b/CHANGELOG
index 94df9218a2..a8d2a7476e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -35,6 +35,8 @@ git-annex (10.20230408) UNRELEASED; urgency=medium
     .git/annex/journal/* with permissions configured by core.sharedRepository.
   * Bug fix: Lock files were created with wrong modes for some combinations
     of core.sharedRepository and umask.
+  * initremote: Avoid creating a remote that is not encrypted when gpg is
+    broken.
 
  -- Joey Hess <id@joeyh.name>  Sat, 08 Apr 2023 13:57:18 -0400
 
diff --git a/Utility/Gpg.hs b/Utility/Gpg.hs
index b5967fab0e..445f65768c 100644
--- a/Utility/Gpg.hs
+++ b/Utility/Gpg.hs
@@ -302,7 +302,10 @@ genSecretKey (GpgCmd cmd) keytype passphrase userid keysize =
  - It is armored, to avoid newlines, since gpg only reads ciphers up to the
  - first newline. -}
 genRandom :: GpgCmd -> Bool -> Size -> IO String
-genRandom cmd highQuality size = checksize <$> readStrict cmd params
+genRandom cmd highQuality size = do
+	s <- readStrict cmd params
+	checksize s
+	return s
   where
 	params = 
 		[ Param "--gen-random"
@@ -325,9 +328,8 @@ genRandom cmd highQuality size = checksize <$> readStrict cmd params
 	expectedlength = size * 8 `div` 6
 
 	checksize s = let len = length s in
-		if len >= expectedlength
-			then s
-			else shortread len
+		unless (len >= expectedlength) $
+			shortread len
 
 	shortread got = giveup $ unwords
 		[ "Not enough bytes returned from gpg", show params
diff --git a/doc/bugs/shared_encryption_bypassed_if_gpg_error_on_init.mdwn b/doc/bugs/shared_encryption_bypassed_if_gpg_error_on_init.mdwn
index a4170bec24..2162f5b3ed 100644
--- a/doc/bugs/shared_encryption_bypassed_if_gpg_error_on_init.mdwn
+++ b/doc/bugs/shared_encryption_bypassed_if_gpg_error_on_init.mdwn
@@ -22,3 +22,6 @@ tried with `10.20230329` and `10.20230408+gc70677e31` on Manjaro
 ### Have you had any luck using git-annex before? (Sometimes we get tired of reading bug reports all day and a lil' positive end note does wonders)
 
 It's awesome 👍
+
+> Indeed, there was a laziness bug that prevented it from exiting early
+> enough. [[fixed|done]] --[[Joey]]