diff --git a/ts/textsecure/MessageReceiver.ts b/ts/textsecure/MessageReceiver.ts
index 989475774b..bdc08e3c3d 100644
--- a/ts/textsecure/MessageReceiver.ts
+++ b/ts/textsecure/MessageReceiver.ts
@@ -1070,6 +1070,8 @@ export default class MessageReceiver
       return undefined;
     }
 
+    strictAssert(uuidKind === UUIDKind.ACI, 'Sealed non-ACI envelope');
+
     const ciphertext = envelope.content || envelope.legacyMessage;
     if (!ciphertext) {
       this.removeFromCache(envelope);
@@ -1441,6 +1443,11 @@ export default class MessageReceiver
       return undefined;
     }
 
+    strictAssert(
+      uuidKind === UUIDKind.PNI || uuidKind === UUIDKind.ACI,
+      `Unsupported uuidKind: ${uuidKind}`
+    );
+
     if (envelope.type === envelopeTypeEnum.PLAINTEXT_CONTENT) {
       log.info(`decrypt/${logId}: plaintext message`);
       const buffer = Buffer.from(ciphertext);