diff --git a/lib/kms/wrapper.js b/lib/kms/wrapper.js
index 4e6465b3a1..4e1d88d64f 100644
--- a/lib/kms/wrapper.js
+++ b/lib/kms/wrapper.js
@@ -136,7 +136,7 @@ function getClientForKey(key, log) {
         // if type was extracted, it is a scality arnPrefix, it needs validation
         // might throw if arn malformed or backend not available
         // for any request (PUT or GET)
-        const error = validateKeyDetail(detail, availableBackends);
+        const error = validateKeyDetail(detail, availableBackends, key);
         if (error) {
             log.error('KMS key arn is invalid', { key, detail, availableBackends });
             return { error };
@@ -266,7 +266,7 @@ class KMS {
                 // otherwise prepend the current KMS client arnPrefix
                 if (isScalityKmsArn(configuredMasterKeyId)) {
                     const detail = extractDetailFromArn(configuredMasterKeyId);
-                    const error = validateKeyDetail(detail, availableBackends);
+                    const error = validateKeyDetail(detail, availableBackends, configuredMasterKeyId);
                     if (error) {
                         return cb(error);
                     }
diff --git a/package.json b/package.json
index 51f97381c5..41eadbf58b 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
         "@opentelemetry/instrumentation-http": "~0.222.0",
         "@opentelemetry/instrumentation-ioredis": "~0.70.0",
         "@opentelemetry/instrumentation-mongodb": "~0.75.0",
-        "@scality/arsenal": "^8.6.0",
+        "@scality/arsenal": "^8.6.1",
         "@scality/bucketclient": "scality/bucketclient#8.3.0",
         "@scality/cloudserverclient": "1.0.13",
         "@scality/scubaclient": "1.2.2",
diff --git a/tests/functional/kmip/serverside_encryption.js b/tests/functional/kmip/serverside_encryption.js
index bc1813adf4..dda40ff79a 100644
--- a/tests/functional/kmip/serverside_encryption.js
+++ b/tests/functional/kmip/serverside_encryption.js
@@ -412,10 +412,16 @@ describe('KMIP backed server-side encryption with other KMSs configured', () =>
     describe('with a key of a KMS that is not configured', () => {
         const keyArn = `${makeScalityArnPrefix(KmsType.external, KmsProtocol.kmip, 'unconfigured')}1`;
 
+        function assertRefusedNamingOnlyTheKey(err) {
+            assertInvalidArgument(err);
+            assert.strictEqual(err.message, `KMS Scality KeyArn "${keyArn}" doesn't match any configured providers`);
+            return true;
+        }
+
         it('should refuse PutObject', () =>
-            assert.rejects(putObject(bucketName, objectName, keyArn), assertInvalidArgument));
+            assert.rejects(putObject(bucketName, objectName, keyArn), assertRefusedNamingOnlyTheKey));
 
         it('should refuse PutBucketEncryption on a bucket without a bucket key', () =>
-            assert.rejects(putBucketEncryption(bucketName, keyArn), assertInvalidArgument));
+            assert.rejects(putBucketEncryption(bucketName, keyArn), assertRefusedNamingOnlyTheKey));
     });
 });
diff --git a/tests/unit/encryption/kms.js b/tests/unit/encryption/kms.js
index 533315e176..cac7270e76 100644
--- a/tests/unit/encryption/kms.js
+++ b/tests/unit/encryption/kms.js
@@ -48,6 +48,37 @@ describe('KMS unit tests', () => {
         });
     });
 
+    describe('with a key of a KMS that is not configured', () => {
+        const keyArn = 'arn:scality:kms:external:kmip:unconfigured:key/1';
+
+        function assertRefusedNamingOnlyTheKey(err) {
+            assert.strictEqual(err.is.InvalidArgument, true);
+            assert.strictEqual(
+                err.description,
+                `KMS Scality KeyArn "${keyArn}" doesn't match any configured providers`,
+            );
+        }
+
+        it('should refuse it on bucket encryption', done => {
+            const sseConfig = parseBucketEncryptionHeaders({
+                'x-amz-scal-server-side-encryption': 'aws:kms',
+                'x-amz-scal-server-side-encryption-aws-kms-key-id': keyArn,
+            });
+            KMS.bucketLevelEncryption(dummyBucket, sseConfig, log, err => {
+                assertRefusedNamingOnlyTheKey(err);
+                done();
+            });
+        });
+
+        it('should refuse it on object encryption', done => {
+            const sseInfo = { algorithm: 'aws:kms', cryptoScheme: 1, mandatory: true, masterKeyId: keyArn };
+            KMS.createCipherBundle(sseInfo, log, err => {
+                assertRefusedNamingOnlyTheKey(err);
+                done();
+            });
+        });
+    });
+
     it(
         'should not construct a sse info object if ' +
             'x-amz-scal-server-side-encryption header contains invalid algorithm option',
diff --git a/yarn.lock b/yarn.lock
index 10e921b8fc..44260e3d34 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1305,10 +1305,10 @@
   resolved "https://registry.yarnpkg.com/@rtsao/scc/-/scc-1.1.0.tgz#927dd2fae9bc3361403ac2c7a00c32ddce9ad7e8"
   integrity sha512-zt6OdqaDoOnJ1ZYsCYGt9YmWzDXl4vQdKTyJev62gFhRGKdx7mcT54V9KIjg+d2wi9EXsPvAPKe7i7WjfVWB8g==
 
-"@scality/arsenal@^8.6.0", "@scality/arsenal@^8.6.0-0":
-  version "8.6.0"
-  resolved "https://registry.yarnpkg.com/@scality/arsenal/-/arsenal-8.6.0.tgz#7d8422893a6f498894e04509cb07f1bcb224e5ab"
-  integrity sha512-RxYMTZf23vd4P1lQEm/H7Jy0yIFZ+2/uFqpp7tLD4lj8iu6Lj8MsF+KxWfB3QLvwVKx9QPsMqSe06QaOPwqh4Q==
+"@scality/arsenal@^8.6.0", "@scality/arsenal@^8.6.1":
+  version "8.6.1"
+  resolved "https://registry.yarnpkg.com/@scality/arsenal/-/arsenal-8.6.1.tgz#f2db3ec8184646282872850d1cce3c16870f053c"
+  integrity sha512-EwKYj0htAbDvDmu4h3EeIG1RwwxGCRvUixQN8NHx9bJIHS5qucQLvNCQ45BNR0q4MDIza3fyE6Xn7DF5hxBBUQ==
   dependencies:
     "@aws-sdk/client-kms" "^3.975.0"
     "@aws-sdk/client-s3" "^3.975.0"
@@ -1406,7 +1406,7 @@
   resolved "https://codeload.github.com/scality/utapi/tar.gz/0977b6b64d04683182da572be7f0aee524d98cf4"
   dependencies:
     "@aws-sdk/client-iam" "^3.975.0"
-    "@scality/arsenal" "^8.6.0-0"
+    "@scality/arsenal" "^8.6.0"
     "@scality/bucketclient" scality/bucketclient#8.3.0
     "@senx/warp10" "1.0.14"
     async "^3.2.6"
@@ -4111,9 +4111,8 @@ http2-wrapper@^1.0.0-beta.5.2:
   dependencies:
     agentkeepalive "^4.5.0"
 
-"httpagent@github:scality/httpagent#1.1.1", httpagent@scality/httpagent#1.1.1:
+"httpagent@github:scality/httpagent#1.1.1":
   version "1.1.1"
-  uid "7c6ef8be1cd89b56651f4a922ea5c92d7673ee2e"
   resolved "https://codeload.github.com/scality/httpagent/tar.gz/7c6ef8be1cd89b56651f4a922ea5c92d7673ee2e"
   dependencies:
     agentkeepalive "^4.6.0"
@@ -7180,7 +7179,7 @@ webidl-conversions@^7.0.0:
     fast-safe-stringify "^2.1.1"
     safe-json-stringify "^1.2.0"
 
-werelogs@scality/werelogs#8.2.5, "werelogs@scality/werelogs#semver:^8.2.4":
+"werelogs@github:scality/werelogs#8.2.5", werelogs@scality/werelogs#8.2.5, "werelogs@scality/werelogs#semver:^8.2.4":
   version "8.2.5"
   resolved "https://codeload.github.com/scality/werelogs/tar.gz/41188826d661227f98ebaaeda7df5e5862809bc7"
   dependencies: