diff --git a/Podfile.lock b/Podfile.lock
index 34424a452..bd341879f 100644
--- a/Podfile.lock
+++ b/Podfile.lock
@@ -196,8 +196,8 @@ DEPENDENCIES:
   - Reachability
   - SignalCoreKit (from `https://github.com/signalapp/SignalCoreKit.git`)
   - SignalCoreKit/Tests (from `https://github.com/signalapp/SignalCoreKit.git`)
-  - SignalMetadataKit (from `https://github.com/signalapp/SignalMetadataKit-Private`)
-  - SignalMetadataKit/Tests (from `https://github.com/signalapp/SignalMetadataKit-Private`)
+  - SignalMetadataKit (from `https://github.com/signalapp/SignalMetadataKit`)
+  - SignalMetadataKit/Tests (from `https://github.com/signalapp/SignalMetadataKit`)
   - SignalServiceKit (from `.`)
   - SignalServiceKit/Tests (from `.`)
   - SocketRocket (from `https://github.com/signalapp/SocketRocket.git`, branch `mkirk/handle-sec-err`)
@@ -233,7 +233,7 @@ EXTERNAL SOURCES:
   SignalCoreKit:
     :git: https://github.com/signalapp/SignalCoreKit.git
   SignalMetadataKit:
-    :git: https://github.com/signalapp/SignalMetadataKit-Private
+    :git: https://github.com/signalapp/SignalMetadataKit
   SignalServiceKit:
     :path: "."
   SocketRocket:
@@ -264,7 +264,7 @@ CHECKOUT OPTIONS:
     :git: https://github.com/signalapp/SignalCoreKit.git
   SignalMetadataKit:
     :commit: 954cbfa767e130626d2e87cc029769a1977c8edd
-    :git: https://github.com/signalapp/SignalMetadataKit-Private
+    :git: https://github.com/signalapp/SignalMetadataKit
   SocketRocket:
     :commit: 9f9563a83cd8960503074aa8de72206f83fb7a69
     :git: https://github.com/signalapp/SocketRocket.git
@@ -298,6 +298,6 @@ SPEC CHECKSUMS:
   YapDatabase: b418a4baa6906e8028748938f9159807fd039af4
   YYImage: 1e1b62a9997399593e4b9c4ecfbbabbf1d3f3b54
 
-PODFILE CHECKSUM: 386d2282c3ff69d0674474511e9c4538daca73da
+PODFILE CHECKSUM: 820287bc7925d7c20e02a02923976c60b1f5386b
 
 COCOAPODS: 1.5.3
diff --git a/SignalServiceKit/src/Messages/OWSMessageDecrypter.m b/SignalServiceKit/src/Messages/OWSMessageDecrypter.m
index 34fa1bfa7..42b27a08f 100644
--- a/SignalServiceKit/src/Messages/OWSMessageDecrypter.m
+++ b/SignalServiceKit/src/Messages/OWSMessageDecrypter.m
@@ -28,6 +28,14 @@
 
 NS_ASSUME_NONNULL_BEGIN
 
+NSError *EnsureDecryptError(nullable NSError *error, NSString *fallbackErrorDescription)
+{
+    if (error) {
+        return error;
+    }
+    return OWSErrorWithCodeDescription(OWSErrorCodeFailedToDecryptUDMessage, fallbackErrorDescription);
+}
+
 @interface OWSMessageDecrypter ()
 
 @property (nonatomic, readonly) OWSPrimaryStorage *primaryStorage;
@@ -350,7 +358,8 @@ NS_ASSUME_NONNULL_BEGIN
                                                        identityStore:self.identityManager
                                                                error:&error];
             if (error || !cipher) {
-                OWSFailDebug(@"%@", @"Could not create secret session cipher: %@", error);
+                OWSFailDebug(@"Could not create secret session cipher: %@", error);
+                error = EnsureDecryptError(error, @"Could not create secret session cipher");
                 return failureBlock(error);
             }
 
@@ -361,7 +370,8 @@ NS_ASSUME_NONNULL_BEGIN
                                                protocolContext:transaction
                                                          error:&error];
             if (error || !decryptResult) {
-                OWSFailDebug(@"%@", @"Could not decrypt UD message: %@", error);
+                OWSFailDebug(@"Could not decrypt UD message: %@", error);
+                error = EnsureDecryptError(error, @"Could not decrypt UD message");
                 return failureBlock(error);
             }
 
@@ -386,10 +396,8 @@ NS_ASSUME_NONNULL_BEGIN
             [envelopeBuilder setSourceDevice:(uint32_t)sourceDeviceId];
             NSData *_Nullable newEnvelopeData = [envelopeBuilder buildSerializedDataAndReturnError:&error];
             if (error || !newEnvelopeData) {
-                NSString *errorDescription =
-                    [NSString stringWithFormat:@"Could not update UD envelope data: %@", error];
-                OWSFailDebug(@"%@", errorDescription);
-                NSError *error = OWSErrorWithCodeDescription(OWSErrorCodeFailedToDecryptMessage, errorDescription);
+                OWSFailDebug(@"Could not update UD envelope data: %@", error);
+                error = EnsureDecryptError(error, @"Could not update UD envelope data");
                 return failureBlock(error);
             }