diff --git a/stores/metadata_test.go b/stores/metadata_test.go
index 5c8d74220..2f2d025ce 100644
--- a/stores/metadata_test.go
+++ b/stores/metadata_test.go
@@ -3474,10 +3474,11 @@ func TestDeleteHostSector(t *testing.T) {
 	}
 
 	// create a healthy slab with one sector that is uploaded to all contracts.
+	key, _ := object.GenerateEncryptionKey().MarshalBinary()
 	root := types.Hash256{1, 2, 3}
 	slab := dbSlab{
 		DBContractSetID:  1,
-		Key:              []byte(object.GenerateEncryptionKey().String()),
+		Key:              key,
 		Health:           1.0,
 		HealthValidUntil: time.Now().Add(time.Hour).Unix(),
 		TotalShards:      1,
diff --git a/stores/types.go b/stores/types.go
index 729a4fbc2..9ec62c9ac 100644
--- a/stores/types.go
+++ b/stores/types.go
@@ -15,6 +15,10 @@ import (
 	"go.sia.tech/core/types"
 )
 
+const (
+	secretKeySize = 32
+)
+
 var zeroCurrency = currency(types.ZeroCurrency)
 
 type (
@@ -47,8 +51,10 @@ func (k *secretKey) Scan(value interface{}) error {
 	bytes, ok := value.([]byte)
 	if !ok {
 		return errors.New(fmt.Sprint("failed to unmarshal secretKey value:", value))
+	} else if len(bytes) != secretKeySize {
+		return fmt.Errorf("failed to unmarshal secretKey value due to invalid number of bytes %v != %v: %v", len(bytes), secretKeySize, value)
 	}
-	*k = secretKey(bytes)
+	*k = append(secretKey{}, secretKey(bytes)...)
 	return nil
 }
 
@@ -68,8 +74,8 @@ func (h *hash256) Scan(value interface{}) error {
 	if !ok {
 		return errors.New(fmt.Sprint("failed to unmarshal hash256 value:", value))
 	}
-	if len(bytes) < len(hash256{}) {
-		return fmt.Errorf("failed to unmarshal hash256 value due to insufficient bytes %v < %v: %v", len(bytes), len(fileContractID{}), value)
+	if len(bytes) != len(hash256{}) {
+		return fmt.Errorf("failed to unmarshal hash256 value due to invalid number of bytes %v != %v: %v", len(bytes), len(fileContractID{}), value)
 	}
 	*h = *(*hash256)(bytes)
 	return nil
@@ -91,8 +97,8 @@ func (fcid *fileContractID) Scan(value interface{}) error {
 	if !ok {
 		return errors.New(fmt.Sprint("failed to unmarshal fcid value:", value))
 	}
-	if len(bytes) < len(fileContractID{}) {
-		return fmt.Errorf("failed to unmarshal fcid value due to insufficient bytes %v < %v: %v", len(bytes), len(fileContractID{}), value)
+	if len(bytes) != len(fileContractID{}) {
+		return fmt.Errorf("failed to unmarshal fcid value due to invalid number of bytes %v != %v: %v", len(bytes), len(fileContractID{}), value)
 	}
 	*fcid = *(*fileContractID)(bytes)
 	return nil
@@ -141,8 +147,8 @@ func (pk *publicKey) Scan(value interface{}) error {
 	if !ok {
 		return errors.New(fmt.Sprint("failed to unmarshal publicKey value:", value))
 	}
-	if len(bytes) < len(types.PublicKey{}) {
-		return fmt.Errorf("failed to unmarshal publicKey value due to insufficient bytes %v < %v: %v", len(bytes), len(publicKey{}), value)
+	if len(bytes) != len(types.PublicKey{}) {
+		return fmt.Errorf("failed to unmarshal publicKey value due invalid number of bytes %v != %v: %v", len(bytes), len(publicKey{}), value)
 	}
 	*pk = *(*publicKey)(bytes)
 	return nil