diff --git a/lib/workers/repository/init/config.js b/lib/workers/repository/init/config.js
index 258f46b245962adb5fca2f3fe514b407712a93fd..93765f4b24153be661a0f3c0420384437b12b977 100644
--- a/lib/workers/repository/init/config.js
+++ b/lib/workers/repository/init/config.js
@@ -96,8 +96,13 @@ async function mergeRenovateConfig(config) {
   delete migratedConfig.errors;
   delete migratedConfig.warnings;
   logger.debug({ config: migratedConfig }, 'renovate.json migrated config');
+  // Decrypt before resolving in case we need npm authentication for any presets
   const decryptedConfig = decryptConfig(migratedConfig, config.privateKey);
-  const resolvedConfig = await presets.resolveConfigPresets(decryptedConfig);
+  // Decrypt after resolving in case the preset contains npm authentication instead
+  const resolvedConfig = decryptConfig(
+    await presets.resolveConfigPresets(decryptedConfig),
+    config.privateKey
+  );
   logger.trace({ config: resolvedConfig }, 'renovate.json resolved config');
   returnConfig = mergeChildConfig(returnConfig, resolvedConfig);
   returnConfig.renovateJsonPresent = true;