diff --git a/.github/workflows/app.yml b/.github/workflows/app.yml
index 6cb18ccf..95e7d19f 100644
--- a/.github/workflows/app.yml
+++ b/.github/workflows/app.yml
@@ -18,6 +18,8 @@ jobs:
     strategy:
       matrix:
         homeserver: [synapse, dendrite, conduit]
+      # since the dendrite job is optional, actually run all tests to the end instead of failing on first error.
+      fail-fast: false
     steps:
       - uses: actions/checkout@v3
       - name: Run tests
@@ -36,8 +38,8 @@ jobs:
           scripts/prepare.sh
           scripts/test_driver.sh"
 
-# coverage is done on the flutter-linux image because we setup olm there
-# coverage_without_olm is done on dart images because why not :D
+  # coverage is done on the flutter-linux image because we setup olm there
+  # coverage_without_olm is done on dart images because why not :D
   coverage:
     runs-on: ubuntu-latest
     container:
diff --git a/lib/encryption/utils/bootstrap.dart b/lib/encryption/utils/bootstrap.dart
index 184d14f1..41a99808 100644
--- a/lib/encryption/utils/bootstrap.dart
+++ b/lib/encryption/utils/bootstrap.dart
@@ -581,6 +581,15 @@ class Bootstrap {
       );
       Logs().v('Store the secret...');
       await newSsssKey?.store(megolmKey, base64.encode(privKey));
+      Logs().v('Wait for secret to come down sync');
+
+      if (!await encryption.keyManager.isCached()) {
+        await client.onSync.stream.firstWhere((syncUpdate) =>
+            syncUpdate.accountData != null &&
+            syncUpdate.accountData!
+                .any((accountData) => accountData.type == megolmKey));
+      }
+
       Logs().v(
           'And finally set all megolm keys as needing to be uploaded again...');
       await client.database?.markInboundGroupSessionsAsNeedingUpload();