diff --git a/src/daemon/run.ts b/src/daemon/run.ts
index 262a150..6637986 100644
--- a/src/daemon/run.ts
+++ b/src/daemon/run.ts
@@ -230,8 +230,14 @@ class Daemon {
 
         if (nsec.startsWith('nsec1')) {
             try {
-                const key = new NDKPrivateKeySigner(nsec);
-                hexpk = key.privateKey!;
+                // NDK 2.8.1's NDKPrivateKeySigner constructor passes its
+                // arg straight to nostr-tools getPublicKey() which requires
+                // 32-byte hex / bytes / bigint, not bech32. Without this
+                // decode, every key created via create_new_key fails to
+                // load with the nostr-tools getPublicKey type error, so
+                // the bunker can never sign for any target it provisions.
+                // See aiolabs/nsecbunkerd#8.
+                hexpk = nip19.decode(nsec).data as string;
             } catch(e) {
                 console.error(`Error loading key ${name}:`, e);
                 return