diff --git a/backend/src/vault/credentials.service.ts b/backend/src/vault/credentials.service.ts
index a1f2328..2741324 100644
--- a/backend/src/vault/credentials.service.ts
+++ b/backend/src/vault/credentials.service.ts
@@ -81,6 +81,17 @@ export class CredentialsService {
         ? this.encryption.decrypt(cred.sshKey.passphraseEncrypted)
         : null;
       sshKey = { privateKey, passphrase };
+    } else if (cred.sshKeyId) {
+      // Orphaned reference — credential points to a deleted/missing SSH key
+      throw new NotFoundException(
+        `Credential "${cred.name}" references SSH key #${cred.sshKeyId} which no longer exists. Re-import the key or update the credential.`,
+      );
+    }
+
+    if (!password && !sshKey) {
+      throw new NotFoundException(
+        `Credential "${cred.name}" has no password or SSH key configured.`,
+      );
     }
 
     return { username: cred.username, domain: cred.domain, password, sshKey };