diff --git a/apps/web/src/device-listener/DeviceListenerCurrentDevice.ts b/apps/web/src/device-listener/DeviceListenerCurrentDevice.ts
index 7dbb976489..0460d82366 100644
--- a/apps/web/src/device-listener/DeviceListenerCurrentDevice.ts
+++ b/apps/web/src/device-listener/DeviceListenerCurrentDevice.ts
@@ -228,21 +228,25 @@ export class DeviceListenerCurrentDevice {
                     logSpan.info("No default 4S key but backup disabled: no toast needed");
                     await this.setDeviceState("ok", logSpan);
                 }
-            } else {
-                // If we get here, then we are verified, have key backup, and
-                // 4S, but allSystemsReady is false, which means that either
-                // secretStorageStatus.ready is false (which means that 4S
-                // doesn't have all the secrets), or we don't have the backup
-                // key cached locally. If any of the cross-signing keys are
-                // missing locally, that is handled by the
-                // `!allCrossSigningSecretsCached` branch above.
-                logSpan.warn("4S is missing secrets or backup key not cached", {
+            } else if (!recoveryIsOk) {
+                logSpan.warn("4S is missing secrets: setting state to KEY_STORAGE_OUT_OF_SYNC", {
                     secretStorageStatus,
                     allCrossSigningSecretsCached,
                     isCurrentDeviceTrusted,
                     keyBackupDownloadIsOk,
                 });
                 await this.setDeviceState("key_storage_out_of_sync", logSpan);
+            } else if (!keyBackupDownloadIsOk) {
+                logSpan.warn("Backup key is not cached locally: setting state to KEY_STORAGE_OUT_OF_SYNC", {
+                    secretStorageStatus,
+                    allCrossSigningSecretsCached,
+                    isCurrentDeviceTrusted,
+                    keyBackupDownloadIsOk,
+                });
+                await this.setDeviceState("key_storage_out_of_sync", logSpan);
+            } else {
+                // We should not get here
+                logSpan.error("DeviceListenerCurrentDevice: allSystemsReady was false, but no case matched.");
             }
         }
     }