diff --git a/main.c b/main.c
index 2b05e252..a6f913af 100644
--- a/main.c
+++ b/main.c
@@ -346,6 +346,17 @@ main(int argc, char * argv[])
 		goto err0;
 	}
 
+	/*
+	 * Explicit parameters only apply to encryption; when decrypting we
+	 * always use the values from the file header.  Reject them here
+	 * rather than violating scryptdec_file_prep's API contract.  The
+	 * all-or-none checks above mean that testing logN is sufficient.
+	 */
+	if (dec && (params.logN != 0)) {
+		warn0("--logN, -r and -p cannot be used when decrypting");
+		goto err0;
+	}
+
 	/* We can't have a maxmemfrac of 0. */
 	if (params.maxmemfrac == 0.0) {
 		warn0("-m must be greater than 0");
diff --git a/tests/09-explicit-params.sh b/tests/09-explicit-params.sh
index 7b75b05b..9c8ab6e3 100644
--- a/tests/09-explicit-params.sh
+++ b/tests/09-explicit-params.sh
@@ -7,6 +7,7 @@ encrypted_file="${s_basename}-reference.enc"
 stderr="${s_basename}-reference.stderr"
 encrypted_file_bad="${s_basename}-reference-bad.enc"
 stderr_bad="${s_basename}-reference-bad.stderr"
+stderr_dec="${s_basename}-dec-explicit.stderr"
 
 scenario_cmd() {
 	# Encrypt with manually-specified N, r, p.
@@ -63,4 +64,19 @@ scenario_cmd() {
 	    enc -p 12 "${reference_file}" 2>&1 |			\
 	    grep -q "If -p is set, --logN and -r must also be set"
 	echo $? > "${c_exitfile}"
+
+	# Explicit parameters are encryption-only; "dec" must reject them
+	# instead of reaching the assertion in scryptdec_file_prep.  Check the
+	# command status independently from the diagnostic so a warn-and-continue
+	# regression cannot false-pass this test.
+	setup_check "scrypt dec Nrp rejected"
+	echo "${password}" | ${c_valgrind_cmd} "${bindir}/scrypt"	\
+	    dec --logN 12 -r 2 -p 3					\
+	    --passphrase dev:stdin-once					\
+	    "${encrypted_file}" > /dev/null 2> "${stderr_dec}"
+	expected_exitcode 1 $? > "${c_exitfile}"
+
+	setup_check "scrypt dec Nrp rejected output"
+	grep -q "\\--logN, -r and -p cannot be used when decrypting" "${stderr_dec}"
+	echo $? > "${c_exitfile}"
 }