diff --git a/src/gtest/test_wallet_notecache.cpp b/src/gtest/test_wallet_notecache.cpp
index dd54dea47..8a9357e63 100644
--- a/src/gtest/test_wallet_notecache.cpp
+++ b/src/gtest/test_wallet_notecache.cpp
@@ -116,6 +116,11 @@ void LegacyFilteredNotes(
     }
 }
 
+class NoteCacheWallet : public CWallet {
+public:
+    bool EncryptKeys(CKeyingMaterial& vMasterKeyIn) { return CCryptoKeyStore::EncryptKeys(vMasterKeyIn); }
+};
+
 std::array<unsigned char, HUSH_MEMO_SIZE> MemoFor(uint64_t value)
 {
     std::array<unsigned char, HUSH_MEMO_SIZE> memo;
@@ -194,7 +199,7 @@ class WalletNoteCache : public ::testing::Test {
 protected:
     static constexpr int TIP_HEIGHT = 30;
 
-    CWallet wallet;
+    NoteCacheWallet wallet;
     SaplingPaymentAddress paA, paB, paC;    // A and C spendable, B viewing key only
     std::map<uint256, int> depthOf;         // txid -> depth to mine it at (absent: never mined)
     std::vector<uint256> txids;
@@ -430,3 +435,20 @@ TEST_F(WalletNoteCacheUndecryptable, SpentAndLockedNotesAreNotDecrypted) {
     for (const SaplingNoteEntry& e : entries)
         EXPECT_FALSE(e.op.hash == txBad);
 }
+
+// The same wallet with its keystore encrypted and locked: spendability then comes from the
+// encrypted-key map (CCryptoKeyStore::HaveSaplingSpendingKey), and nothing else may change.
+class WalletNoteCacheEncrypted : public WalletNoteCache {
+protected:
+    void AddMoreTxs() override {
+        CKeyingMaterial masterKey(32, 0x42);
+        ASSERT_TRUE(wallet.EncryptKeys(masterKey));
+        ASSERT_TRUE(wallet.IsCrypted());
+        ASSERT_TRUE(wallet.IsLocked());
+    }
+};
+
+TEST_F(WalletNoteCacheEncrypted, LockedWalletMatchesLegacy) {
+    EXPECT_EQ(6u, Filtered({}, 1, INT_MAX, true, true, false).size()) << "A's and C's keys are still known";
+    ExpectEquivalent({1, 11});
+}
diff --git a/src/wallet/crypter.cpp b/src/wallet/crypter.cpp
index fa29dba19..336b07f3a 100644
--- a/src/wallet/crypter.cpp
+++ b/src/wallet/crypter.cpp
@@ -591,7 +591,7 @@ bool CCryptoKeyStore::GetSaplingSpendingKey(const libzcash::SaplingFullViewingKe
         if (!IsCrypted())
             return CBasicKeyStore::GetSaplingSpendingKey(fvk, skOut);
 
-        for (auto entry : mapCryptedSaplingSpendingKeys) {
+        for (const auto& entry : mapCryptedSaplingSpendingKeys) {
             if (entry.first.fvk == fvk) {
                 const std::vector<unsigned char> &vchCryptedSecret = entry.second;
                 return DecryptSaplingSpendingKey(vMasterKey, vchCryptedSecret, entry.first, skOut);
diff --git a/src/wallet/crypter.h b/src/wallet/crypter.h
index d79a1b34b..282e39a85 100644
--- a/src/wallet/crypter.h
+++ b/src/wallet/crypter.h
@@ -265,7 +265,7 @@ public:
             LOCK(cs_SpendingKeyStore);
             if (!IsCrypted())
                 return CBasicKeyStore::HaveSaplingSpendingKey(fvk);
-            for (auto entry : mapCryptedSaplingSpendingKeys) {
+            for (const auto& entry : mapCryptedSaplingSpendingKeys) {
                 if (entry.first.fvk == fvk) {
                     return true;
                 }