diff --git a/hbs2-cli/lib/HBS2/CLI/Run/Internal/GroupKey.hs b/hbs2-cli/lib/HBS2/CLI/Run/Internal/GroupKey.hs
index 1023443d..dac57267 100644
--- a/hbs2-cli/lib/HBS2/CLI/Run/Internal/GroupKey.hs
+++ b/hbs2-cli/lib/HBS2/CLI/Run/Internal/GroupKey.hs
@@ -54,7 +54,7 @@ decryptBlock :: (MonadUnliftIO m, Serialise t)
              -> SmallEncryptedBlock t
              -> m t
 decryptBlock sto seb = do
-  let find gk = runKeymanClient (extractGroupKeySecret gk)
+  let find gk = runKeymanClientRO (findMatchedGroupKeySecret sto gk)
 
   -- FIXME: improve-error-diagnostics
   runExceptT (Symm.decryptBlock sto find seb)
diff --git a/hbs2-sync/src/HBS2/Sync/State.hs b/hbs2-sync/src/HBS2/Sync/State.hs
index a07f3516..faab4dda 100644
--- a/hbs2-sync/src/HBS2/Sync/State.hs
+++ b/hbs2-sync/src/HBS2/Sync/State.hs
@@ -284,6 +284,7 @@ getStateFromRefChan rchan = do
 
     let krs = HM.fromList [ (pk,e) | e@(KeyringEntry pk _ _) <- krl ]
 
+    -- FIXME: asap-insert-findMatchedGroupKey
     let findKey gk = do
           r <- S.toList_ do
                 forM_ (HM.toList $ recipients gk) $ \(pk,box) -> runMaybeT do