diff --git a/crates/relicario-core/src/org.rs b/crates/relicario-core/src/org.rs
index 5b02caa..caceaf2 100644
--- a/crates/relicario-core/src/org.rs
+++ b/crates/relicario-core/src/org.rs
@@ -304,9 +304,9 @@ pub fn unwrap_org_key(wrapped: &[u8], ed25519_seed: &Zeroizing<[u8; 32]>) -> Res
         return Err(RelicarioError::Format("wrapped key blob too short".into()));
     }
 
-    let ephemeral_pk = x25519_dalek::PublicKey::from(
-        <[u8; 32]>::try_from(&wrapped[..32]).unwrap()
-    );
+    let mut eph_bytes = [0u8; 32];
+    eph_bytes.copy_from_slice(&wrapped[..32]);
+    let ephemeral_pk = x25519_dalek::PublicKey::from(eph_bytes);
     let encrypted = &wrapped[32..];
 
     let recipient_sk = ed25519_seed_to_x25519_secret(ed25519_seed);
@@ -359,6 +359,7 @@ mod tests {
     fn org_id_is_16_hex_chars() {
         let id = OrgId::new();
         assert_eq!(id.0.len(), 16);
+        assert!(id.0.chars().all(|c| c.is_ascii_hexdigit()));
     }
 
     #[test]