diff --git a/src/main/runtime/rpc/e2ee-channel.test.ts b/src/main/runtime/rpc/e2ee-channel.test.ts
index dfac64f5189..383af48069b 100644
--- a/src/main/runtime/rpc/e2ee-channel.test.ts
+++ b/src/main/runtime/rpc/e2ee-channel.test.ts
@@ -192,9 +192,9 @@ describe('E2EEChannel', () => {
       expect(ctx.onReady).not.toHaveBeenCalled()
     })
 
-    it('rejects malformed JSON', () => {
+    it.each(['not json', 'null'])('rejects invalid handshake JSON: %s', (raw) => {
       const ctx = setup()
-      ctx.channel.handleRawMessage('not json')
+      ctx.channel.handleRawMessage(raw)
 
       expect(ctx.onError).toHaveBeenCalledWith(4001, 'Invalid handshake message')
     })
diff --git a/src/main/runtime/rpc/e2ee-channel.ts b/src/main/runtime/rpc/e2ee-channel.ts
index 34b9aa777a8..cdba6b9d02f 100644
--- a/src/main/runtime/rpc/e2ee-channel.ts
+++ b/src/main/runtime/rpc/e2ee-channel.ts
@@ -188,7 +188,12 @@ export class E2EEChannel {
   private handleHello(raw: string): void {
     let hello: Record<string, unknown>
     try {
-      hello = parseRemoteRuntimeJsonText(raw) as Record<string, unknown>
+      const parsed = parseRemoteRuntimeJsonText(raw)
+      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        this.onError(4001, 'Invalid handshake message')
+        return
+      }
+      hello = { ...parsed }
     } catch {
       this.onError(4001, 'Invalid handshake message')
       return