diff --git a/docs/proxy-setup.md b/docs/proxy-setup.md
index de38cb872..339dfb3f3 100644
--- a/docs/proxy-setup.md
+++ b/docs/proxy-setup.md
@@ -176,8 +176,8 @@ created earlier:
 
 ```bash
 $ gcloud kms encrypt --plaintext-file <combined_secret.pem> \
---ciphertext-file <combined_secret.pem.enc> \
---key <key-name> --keyring <keyring-name> --location global
+--ciphertext-file - --key <key-name> --keyring <keyring-name> --location \
+global | base64 > <combined_secret.pem.enc>
 ```
 
 This encrypted file is then uploaded to a GCS bucket specified in the
diff --git a/java/google/registry/proxy/ProxyModule.java b/java/google/registry/proxy/ProxyModule.java
index d61814210..aa478b148 100644
--- a/java/google/registry/proxy/ProxyModule.java
+++ b/java/google/registry/proxy/ProxyModule.java
@@ -49,6 +49,7 @@ import io.netty.handler.ssl.SslProvider;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.util.Arrays;
+import java.util.Base64;
 import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.ExecutorService;
@@ -249,7 +250,7 @@ public class ProxyModule {
           .objects()
           .get(config.gcs.bucket, config.gcs.sslPemFilename)
           .executeMediaAndDownloadTo(outputStream);
-      return outputStream.toByteArray();
+      return Base64.getMimeDecoder().decode(outputStream.toByteArray());
     } catch (IOException e) {
       throw new RuntimeException(
           String.format(