diff --git a/framework/src/Volo.Abp.Settings/Volo/Abp/Settings/AbpSettingOptions.cs b/framework/src/Volo.Abp.Settings/Volo/Abp/Settings/AbpSettingOptions.cs
index c8a06736b6..e4bbb4fe00 100644
--- a/framework/src/Volo.Abp.Settings/Volo/Abp/Settings/AbpSettingOptions.cs
+++ b/framework/src/Volo.Abp.Settings/Volo/Abp/Settings/AbpSettingOptions.cs
@@ -11,10 +11,17 @@ public class AbpSettingOptions
 
     public HashSet<string> DeletedSettings { get; }
 
+    /// <summary>
+    /// Default: true.
+    /// This is useful when you change <see cref="SettingDefinition.IsEncrypted"/> of an existing setting definition to true and don't want to lose the original value.
+    /// </summary>
+    public bool ReturnOriginalValueIfDecryptFailed { get; set; }
+
     public AbpSettingOptions()
     {
         DefinitionProviders = new TypeList<ISettingDefinitionProvider>();
         ValueProviders = new TypeList<ISettingValueProvider>();
         DeletedSettings = new HashSet<string>();
+        ReturnOriginalValueIfDecryptFailed = true;
     }
 }
diff --git a/framework/src/Volo.Abp.Settings/Volo/Abp/Settings/SettingEncryptionService.cs b/framework/src/Volo.Abp.Settings/Volo/Abp/Settings/SettingEncryptionService.cs
index 45a3362d30..2af6b7b4af 100644
--- a/framework/src/Volo.Abp.Settings/Volo/Abp/Settings/SettingEncryptionService.cs
+++ b/framework/src/Volo.Abp.Settings/Volo/Abp/Settings/SettingEncryptionService.cs
@@ -1,6 +1,7 @@
 using System;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
 using Volo.Abp.DependencyInjection;
 using Volo.Abp.Security.Encryption;
 
@@ -10,10 +11,12 @@ public class SettingEncryptionService : ISettingEncryptionService, ITransientDep
 {
     protected IStringEncryptionService StringEncryptionService { get; }
     public ILogger<SettingEncryptionService> Logger { get; set; }
+    protected IOptions<AbpSettingOptions> Options { get; }
 
-    public SettingEncryptionService(IStringEncryptionService stringEncryptionService)
+    public SettingEncryptionService(IStringEncryptionService stringEncryptionService, IOptions<AbpSettingOptions> options)
     {
         StringEncryptionService = stringEncryptionService;
+        Options = options;
         Logger = NullLogger<SettingEncryptionService>.Instance;
     }
 
@@ -40,7 +43,14 @@ public class SettingEncryptionService : ISettingEncryptionService, ITransientDep
         }
         catch (Exception e)
         {
+            if (Options.Value.ReturnOriginalValueIfDecryptFailed)
+            {
+                Logger.LogWarning(e, "Failed to decrypt the setting: {0}. Returning the original value...", settingDefinition.Name);
+                return encryptedValue;
+            }
+            
             Logger.LogException(e);
+            
             return string.Empty;
         }
     }