diff --git a/crates/crypto/Cargo.toml b/crates/crypto/Cargo.toml
index 651066731..1a9888f1a 100644
--- a/crates/crypto/Cargo.toml
+++ b/crates/crypto/Cargo.toml
@@ -35,7 +35,7 @@ chacha20poly1305 = { workspace = true, optional = true }
 jsonwebtoken = { workspace = true }
 base64-simd = { workspace = true }
 pbkdf2 = { workspace = true, optional = true }
-rand = { workspace = true, optional = true }
+rand = { workspace = true }
 rsa = { workspace = true, features = ["sha2"] }
 serde = { workspace = true, features = ["derive"] }
 sha2 = { workspace = true, optional = true }
@@ -55,7 +55,6 @@ crypto = [
     "dep:argon2",
     "dep:chacha20poly1305",
     "dep:pbkdf2",
-    "dep:rand",
     "dep:sha2",
 ]
 
diff --git a/crates/crypto/src/encdec.rs b/crates/crypto/src/encdec.rs
index 86bb5a476..66e215d23 100644
--- a/crates/crypto/src/encdec.rs
+++ b/crates/crypto/src/encdec.rs
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#[cfg(not(feature = "fips"))]
+#[cfg(all(any(test, feature = "crypto"), not(feature = "fips")))]
 mod aes;
 
 #[cfg(any(test, feature = "crypto"))]
diff --git a/crates/crypto/src/encdec/decrypt.rs b/crates/crypto/src/encdec/decrypt.rs
index 18f20a9c3..d8d7cb358 100644
--- a/crates/crypto/src/encdec/decrypt.rs
+++ b/crates/crypto/src/encdec/decrypt.rs
@@ -53,6 +53,6 @@ fn decrypt<T: aes_gcm::aead::Aead>(stream: T, nonce: &[u8], data: &[u8]) -> Resu
 }
 
 #[cfg(not(any(test, feature = "crypto")))]
-pub fn decrypt_data(_password: &[u8], data: &[u8]) -> Result<Vec<u8>, crate::Error> {
-    Ok(data.to_vec())
+pub fn decrypt_data(_password: &[u8], _data: &[u8]) -> Result<Vec<u8>, crate::Error> {
+    Err(crate::Error::ErrCryptoDisabled)
 }
diff --git a/crates/crypto/src/encdec/encrypt.rs b/crates/crypto/src/encdec/encrypt.rs
index d92be2d31..6b3eecbea 100644
--- a/crates/crypto/src/encdec/encrypt.rs
+++ b/crates/crypto/src/encdec/encrypt.rs
@@ -75,6 +75,6 @@ fn encrypt<T: aes_gcm::aead::Aead>(
 }
 
 #[cfg(not(any(test, feature = "crypto")))]
-pub fn encrypt_data(_password: &[u8], data: &[u8]) -> Result<Vec<u8>, crate::Error> {
-    Ok(data.to_vec())
+pub fn encrypt_data(_password: &[u8], _data: &[u8]) -> Result<Vec<u8>, crate::Error> {
+    Err(crate::Error::ErrCryptoDisabled)
 }
diff --git a/crates/crypto/src/error.rs b/crates/crypto/src/error.rs
index d67d6320c..953f0a9ad 100644
--- a/crates/crypto/src/error.rs
+++ b/crates/crypto/src/error.rs
@@ -26,6 +26,9 @@ pub enum Error {
     #[error("invalid key length")]
     ErrInvalidKeyLength,
 
+    #[error("crypto feature is disabled")]
+    ErrCryptoDisabled,
+
     #[cfg(any(test, feature = "crypto"))]
     #[error("{0}")]
     ErrInvalidLength(#[from] sha2::digest::InvalidLength),
diff --git a/crates/crypto/tests/no_crypto_feature.rs b/crates/crypto/tests/no_crypto_feature.rs
new file mode 100644
index 000000000..cabd20da1
--- /dev/null
+++ b/crates/crypto/tests/no_crypto_feature.rs
@@ -0,0 +1,21 @@
+#![cfg(not(feature = "crypto"))]
+
+use rustfs_crypto::{Error, decrypt_data, encrypt_data};
+
+#[test]
+fn encrypt_data_returns_error_without_crypto_feature() {
+    let plain = b"must not be returned as ciphertext";
+
+    let result = encrypt_data(b"password", plain);
+
+    assert!(matches!(result, Err(Error::ErrCryptoDisabled)));
+}
+
+#[test]
+fn decrypt_data_returns_error_without_crypto_feature() {
+    let ciphertext = b"must not be returned as plaintext";
+
+    let result = decrypt_data(b"password", ciphertext);
+
+    assert!(matches!(result, Err(Error::ErrCryptoDisabled)));
+}