diff --git a/crates/kms/src/backends/vault_transit.rs b/crates/kms/src/backends/vault_transit.rs
index 08a3e03e7..a04d99e1f 100644
--- a/crates/kms/src/backends/vault_transit.rs
+++ b/crates/kms/src/backends/vault_transit.rs
@@ -535,10 +535,11 @@ impl KmsBackend for VaultTransitKmsBackend {
     }
 
     async fn decrypt(&self, request: DecryptRequest) -> Result<DecryptResponse> {
+        let envelope = DataKeyEnvelope::deserialize(&request.ciphertext_blob)?;
         let plaintext = self.client.decrypt(&request, None).await?;
         Ok(DecryptResponse {
             plaintext,
-            key_id: "vault-transit".to_string(),
+            key_id: envelope.master_key_id,
             encryption_algorithm: Some("vault-transit".to_string()),
         })
     }