diff --git a/lambda/backup-verification/app.py b/lambda/backup-verification/app.py
index 46e4828..2dec9aa 100644
--- a/lambda/backup-verification/app.py
+++ b/lambda/backup-verification/app.py
@@ -199,7 +199,13 @@ def handler(event, context):
         blocks.append({"type": "section", "text": {"type": "mrkdwn", "text": f"*Overall:* {overall}"}})
 
     else:
-        raise ValueError(f"Unknown mode: {mode!r} (expected 'daily' or 'restore-test')")
+        return {
+            "statusCode": 400,
+            "body": json.dumps({
+                "mode": mode,
+                "error": f"Unsupported backup verification mode: {mode}",
+            }),
+        }
 
     _post_slack(blocks)
 
diff --git a/lib/forgejo-stack.ts b/lib/forgejo-stack.ts
index be9b46f..732079c 100644
--- a/lib/forgejo-stack.ts
+++ b/lib/forgejo-stack.ts
@@ -2,6 +2,7 @@ import * as cdk from "aws-cdk-lib";
 import * as ec2 from "aws-cdk-lib/aws-ec2";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as s3 from "aws-cdk-lib/aws-s3";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import * as elbv2_targets from "aws-cdk-lib/aws-elasticloadbalancingv2-targets";
 import * as route53 from "aws-cdk-lib/aws-route53";
@@ -145,16 +146,15 @@ export class ForgejoStack extends cdk.Stack {
       user: gcsTransferUser,
     });
 
-    new cdk.aws_secretsmanager.CfnSecret(this, "GcsTransferCredentials", {
-      name: "forgejo/gcs-transfer-credentials",
-      secretString: cdk.Fn.join("", [
-        '{"accessKeyId":"',
-        gcsTransferKey.accessKeyId,
-        '","secretAccessKey":"',
-        gcsTransferKey.secretAccessKey.unsafeUnwrap(),
-        '"}',
-      ]),
+    const gcsTransferCredentials = new secretsmanager.Secret(this, "GcsTransferCredentials", {
+      secretName: "forgejo/gcs-transfer-credentials",
+      secretObjectValue: {
+        accessKeyId: cdk.SecretValue.unsafePlainText(gcsTransferKey.accessKeyId),
+        secretAccessKey: gcsTransferKey.secretAccessKey,
+      },
     });
+    const gcsTransferCredentialsResource = gcsTransferCredentials.node.defaultChild as secretsmanager.CfnSecret;
+    gcsTransferCredentialsResource.overrideLogicalId("GcsTransferCredentials");
 
     const userData = ec2.UserData.forLinux();
     userData.addCommands(