diff --git a/internal/rbd/controllerserver.go b/internal/rbd/controllerserver.go
index cf3d5c2ee..e8d7460aa 100644
--- a/internal/rbd/controllerserver.go
+++ b/internal/rbd/controllerserver.go
@@ -690,12 +690,6 @@ func (cs *ControllerServer) DeleteVolume(ctx context.Context, req *csi.DeleteVol
 		return nil, status.Error(codes.Internal, err.Error())
 	}
 
-	if rbdVol.isEncrypted() {
-		if err = rbdVol.encryption.RemoveDEK(rbdVol.VolID); err != nil {
-			util.WarningLog(ctx, "failed to clean the passphrase for volume %s: %s", rbdVol.VolID, err)
-		}
-	}
-
 	return &csi.DeleteVolumeResponse{}, nil
 }
 
diff --git a/internal/rbd/rbd_util.go b/internal/rbd/rbd_util.go
index b0ff5a16a..eef2bba1f 100644
--- a/internal/rbd/rbd_util.go
+++ b/internal/rbd/rbd_util.go
@@ -475,6 +475,12 @@ func deleteImage(ctx context.Context, pOpts *rbdVolume, cr *util.Credentials) er
 
 	util.DebugLog(ctx, "rbd: delete %s using mon %s, pool %s", image, pOpts.Monitors, pOpts.Pool)
 
+	if pOpts.isEncrypted() {
+		if err = pOpts.encryption.RemoveDEK(pOpts.VolID); err != nil {
+			util.WarningLog(ctx, "failed to clean the passphrase for volume %s: %s", pOpts.VolID, err)
+		}
+	}
+
 	err = pOpts.openIoctx()
 	if err != nil {
 		return err