diff --git a/src/restic/repository/prune.go b/src/restic/repository/prune.go
index d4a481ec9..915843474 100644
--- a/src/restic/repository/prune.go
+++ b/src/restic/repository/prune.go
@@ -49,6 +49,11 @@ func Repack(repo *Repository, packs, keepBlobs backend.IDSet) (err error) {
 			}
 
 			ciphertext := buf[entry.Offset : entry.Offset+entry.Length]
+
+			if cap(plaintext) < len(ciphertext) {
+				plaintext = make([]byte, len(ciphertext))
+			}
+
 			plaintext, err = crypto.Decrypt(repo.Key(), plaintext, ciphertext)
 			if err != nil {
 				return err