diff --git a/activesupport/lib/active_support/encrypted_configuration.rb b/activesupport/lib/active_support/encrypted_configuration.rb
index 67db453d49..fd8ab6c7c3 100644
--- a/activesupport/lib/active_support/encrypted_configuration.rb
+++ b/activesupport/lib/active_support/encrypted_configuration.rb
@@ -35,7 +35,13 @@ module ActiveSupport
 
     private
       def deep_transform(hash)
-        hash.transform_values { |value| value.is_a?(Hash) ? ActiveSupport::InheritableOptions.new(deep_transform(value)) : value }
+        return hash unless hash.is_a?(Hash)
+
+        h = ActiveSupport::InheritableOptions.new
+        hash.each do |k, v|
+          h[k] = deep_transform(v)
+        end
+        h
       end
 
       def options
diff --git a/activesupport/test/encrypted_configuration_test.rb b/activesupport/test/encrypted_configuration_test.rb
index dde15d4b98..521d7d83a8 100644
--- a/activesupport/test/encrypted_configuration_test.rb
+++ b/activesupport/test/encrypted_configuration_test.rb
@@ -45,6 +45,8 @@ class EncryptedConfigurationTest < ActiveSupport::TestCase
     assert_not @credentials.something.bad
     assert_equal "bar", @credentials.dig(:something, :nested, :foo)
     assert_equal "bar", @credentials.something.nested.foo
+    assert_equal [:good, :bad, :nested], @credentials.something.keys
+    assert_equal ({ good: true, bad: false, nested: { foo: "bar" } }), @credentials.something
   end
 
   test "reading comment-only configuration" do