diff --git a/includes/class-m365-login-settings.php b/includes/class-m365-login-settings.php
index 8fcbfaf..a4b8bd6 100644
--- a/includes/class-m365-login-settings.php
+++ b/includes/class-m365-login-settings.php
@@ -19,6 +19,13 @@ class M365_Login_Settings {
 	 */
 	private $cache = null;
 
+	/**
+	 * Set while the plugin writes already sanitised values (skips the form sanitiser).
+	 *
+	 * @var bool
+	 */
+	private $raw_write = false;
+
 	/**
 	 * Default settings.
 	 *
@@ -199,8 +206,7 @@ class M365_Login_Settings {
 		$all                     = $this->all();
 		$all['cert_private_key'] = $enc;
 		$all['cert_certificate'] = $pair['certificate'];
-		update_option( M365_LOGIN_OPTION, $all );
-		$this->cache = null;
+		$this->write( $all );
 		return true;
 	}
 
@@ -211,8 +217,22 @@ class M365_Login_Settings {
 		$all                     = $this->all();
 		$all['cert_private_key'] = '';
 		$all['cert_certificate'] = '';
+		$this->write( $all );
+	}
+
+	/**
+	 * Stores already sanitised settings.
+	 *
+	 * The option is registered with sanitize() as callback, which expects raw form input
+	 * (it would, for example, encrypt the stored client secret a second time).
+	 *
+	 * @param array $all Complete settings.
+	 */
+	private function write( $all ) {
+		$this->raw_write = true;
 		update_option( M365_LOGIN_OPTION, $all );
-		$this->cache = null;
+		$this->raw_write = false;
+		$this->cache     = null;
 	}
 
 	/**
@@ -379,6 +399,10 @@ class M365_Login_Settings {
 	 * @return array
 	 */
 	public function sanitize( $input ) {
+		if ( $this->raw_write ) {
+			return $input;
+		}
+
 		$defaults = $this->defaults();
 		$current  = $this->all();
 		$input    = is_array( $input ) ? $input : array();