diff --git a/src/app/imex/sync/supersync-encryption-toggle.service.ts b/src/app/imex/sync/supersync-encryption-toggle.service.ts
index 5d3cc178ad..dc5cfa4b13 100644
--- a/src/app/imex/sync/supersync-encryption-toggle.service.ts
+++ b/src/app/imex/sync/supersync-encryption-toggle.service.ts
@@ -59,7 +59,10 @@ export class SuperSyncEncryptionToggleService {
       // Revert config on failure (server data is already deleted at this point)
       SyncLog.err(`${LOG_PREFIX}: Failed after deleting server data!`, error);
 
-      // Best-effort revert: restore original config (preserves auth credentials and original encryption state)
+      // Best-effort revert: restore pre-enable config.
+      // existingCfg was captured before enabling, so it already has isEncryptionEnabled: false
+      // and no encryptKey. The explicit overrides ensure correctness even if the guard above
+      // was bypassed (e.g., existingCfg was partially set).
       await this._providerManager.setProviderConfig(SyncProviderId.SuperSync, {
         ...existingCfg,
         encryptKey: undefined,
diff --git a/src/app/op-log/persistence/sync-hydration.service.ts b/src/app/op-log/persistence/sync-hydration.service.ts
index 38613d3e53..f2ed3be4e3 100644
--- a/src/app/op-log/persistence/sync-hydration.service.ts
+++ b/src/app/op-log/persistence/sync-hydration.service.ts
@@ -252,7 +252,10 @@ export class SyncHydrationService {
       let clockForStorage: Record<string, number>;
       if (createSyncImportOp) {
         clockForStorage = {};
-        clockForStorage[clientId] = newClock[clientId];
+        // Guard against undefined — consistent with mergeRemoteOpClocks() in OperationLogStoreService
+        if (newClock[clientId] !== undefined) {
+          clockForStorage[clientId] = newClock[clientId];
+        }
         OpLog.normal('SyncHydrationService: Reset working clock to minimal after sync', {
           fullClockSize: Object.keys(newClock).length,
           minimalClockSize: Object.keys(clockForStorage).length,