diff --git a/cmd/syncthing/decrypt/decrypt.go b/cmd/syncthing/decrypt/decrypt.go
index cfd3364c6..0247bb20f 100644
--- a/cmd/syncthing/decrypt/decrypt.go
+++ b/cmd/syncthing/decrypt/decrypt.go
@@ -18,6 +18,7 @@ import (
 
 	"github.com/syncthing/syncthing/lib/config"
 	"github.com/syncthing/syncthing/lib/fs"
+	"github.com/syncthing/syncthing/lib/osutil"
 	"github.com/syncthing/syncthing/lib/protocol"
 	"github.com/syncthing/syncthing/lib/scanner"
 )
@@ -79,7 +80,7 @@ func (c *CLI) walk() error {
 		dstFs = fs.NewFilesystem(fs.FilesystemTypeBasic, c.To)
 	}
 
-	return srcFs.Walk("/", func(path string, info fs.FileInfo, err error) error {
+	return srcFs.Walk(".", func(path string, info fs.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
@@ -142,6 +143,10 @@ func (c *CLI) process(srcFs fs.Filesystem, dstFs fs.Filesystem, path string) err
 		return fmt.Errorf("%s: loading metadata trailer: %w", path, err)
 	}
 
+	// Workaround for a bug in <= v1.15.0-rc.5 where we stored names
+	// in native format, while protocol expects wire format (slashes).
+	encFi.Name = osutil.NormalizedFilename(encFi.Name)
+
 	plainFi, err := protocol.DecryptFileInfo(*encFi, c.folderKey)
 	if err != nil {
 		return fmt.Errorf("%s: decrypting metadata: %w", path, err)
diff --git a/lib/model/sharedpullerstate.go b/lib/model/sharedpullerstate.go
index d6d26e92d..ccd05e26b 100644
--- a/lib/model/sharedpullerstate.go
+++ b/lib/model/sharedpullerstate.go
@@ -13,6 +13,7 @@ import (
 	"github.com/pkg/errors"
 
 	"github.com/syncthing/syncthing/lib/fs"
+	"github.com/syncthing/syncthing/lib/osutil"
 	"github.com/syncthing/syncthing/lib/protocol"
 	"github.com/syncthing/syncthing/lib/sync"
 )
@@ -346,8 +347,13 @@ func (s *sharedPullerState) finalClose() (bool, error) {
 // folder from encrypted data we can extract this FileInfo from the end of
 // the file and regain the original metadata.
 func (s *sharedPullerState) finalizeEncrypted() error {
-	bs := make([]byte, encryptionTrailerSize(s.file))
-	n, err := s.file.MarshalTo(bs)
+	// Here the file is in native format, while encryption happens in
+	// wire format (always slashes).
+	wireFile := s.file
+	wireFile.Name = osutil.NormalizedFilename(wireFile.Name)
+
+	bs := make([]byte, encryptionTrailerSize(wireFile))
+	n, err := wireFile.MarshalTo(bs)
 	if err != nil {
 		return err
 	}
@@ -359,7 +365,7 @@ func (s *sharedPullerState) finalizeEncrypted() error {
 			return err
 		}
 	}
-	if _, err := s.writer.WriteAt(bs, s.file.Size); err != nil {
+	if _, err := s.writer.WriteAt(bs, wireFile.Size); err != nil {
 		return err
 	}