diff --git a/Codec/Encryption/OpenPGP/Serialize.hs b/Codec/Encryption/OpenPGP/Serialize.hs
--- a/Codec/Encryption/OpenPGP/Serialize.hs
+++ b/Codec/Encryption/OpenPGP/Serialize.hs
@@ -1596,14 +1596,9 @@
     | pka `elem` [X25519, X448]
     , (ephMPI NE.:| [wrappedMPI]) <- mpis = do
         putByteString (i2osp (unMPI ephMPI))
-        let rawWrapped = i2osp (unMPI wrappedMPI)
-            targetLen =
-                headDef
-                    (B.length rawWrapped)
-                    (filter (>= B.length rawWrapped) [32, 40, 48])
-            paddedWrapped = leftPadTo targetLen rawWrapped
-        putWord8 (fromIntegral (B.length paddedWrapped))
-        putByteString paddedWrapped
+        let eskBytes = i2osp (unMPI wrappedMPI)
+        putWord8 (fromIntegral (B.length eskBytes))
+        putByteString eskBytes
     | pka == ECDH
     , (ephMPI NE.:| [wrappedMPI]) <- mpis = do
         put ephMPI
diff --git a/Codec/Encryption/OpenPGP/Signatures.hs b/Codec/Encryption/OpenPGP/Signatures.hs
--- a/Codec/Encryption/OpenPGP/Signatures.hs
+++ b/Codec/Encryption/OpenPGP/Signatures.hs
@@ -118,6 +118,7 @@
     , emptyPSC
     , issuer
     , issuerFP
+    , leftPadTo
     )
 import Codec.Encryption.OpenPGP.Internal.Whitespace
     ( canonicalizeLineEndings
@@ -1260,7 +1261,11 @@
     ed448Verify sigPka _ _ _ _ _ =
         verificationError (SignatureShapeMismatch sigPka)
     edPointToRawPublic expectedLen (NativeEPoint (EPoint x)) =
-        exactLengthPublic expectedLen "native" (i2osp x)
+        let bs = i2osp x
+            l = B.length bs
+         in if l > expectedLen
+                then Left (BadLength "native" expectedLen l)
+                else Right (leftPadTo expectedLen bs)
     edPointToRawPublic expectedLen (PrefixedNativeEPoint (EPoint x)) = do
         prefixed <-
             exactLengthPublic (expectedLen + 1) "prefixed-native" (i2osp x)
diff --git a/hOpenPGP.cabal b/hOpenPGP.cabal
--- a/hOpenPGP.cabal
+++ b/hOpenPGP.cabal
@@ -1,6 +1,6 @@
 Cabal-version:       3.4
 Name:                hOpenPGP
-Version:             3.6.6
+Version:             3.6.7
 Synopsis:            native Haskell implementation of OpenPGP (RFC9580)
 Description:         native Haskell implementation of OpenPGP (RFC9580), with some backwards compatibility
 Homepage:            https://salsa.debian.org/clint/hOpenPGP
@@ -173,6 +173,7 @@
   , tests/data/v6.msg
   , tests/data/v6.txt
   , tests/data/v6.txt.sig
+  , tests/data/seipdv1-two-recipients.pgp.aa
 
 flag use-memory
   description: Use the 'memory' package instead of 'ram'
@@ -346,4 +347,4 @@
 source-repository this
   type:     git
   location: https://salsa.debian.org/clint/hOpenPGP.git
-  tag:      v3.6.6
+  tag:      v3.6.7
diff --git a/tests/Tests/Serialization.hs b/tests/Tests/Serialization.hs
--- a/tests/Tests/Serialization.hs
+++ b/tests/Tests/Serialization.hs
@@ -360,6 +360,9 @@
             , testCase
                 "should pad P-521 EC coordinates to 66-byte field width"
                 testPointSerializationP521PadsTo66Bytes
+            , testCase
+                "can deserialize a v3 PKESK for X25519"
+                (testSerialization "seipdv1-two-recipients.pgp.aa")
             ]
         , testGroup
             "TKUnknown Serialization group"
diff --git a/tests/data/seipdv1-two-recipients.pgp.aa b/tests/data/seipdv1-two-recipients.pgp.aa
new file mode 100644
--- /dev/null
+++ b/tests/data/seipdv1-two-recipients.pgp.aa
@@ -0,0 +1,10 @@
+-----BEGIN PGP MESSAGE-----
+
+wVQDT2vkM4aYeOEZXPeCx3fAcj9tUzsrbVMNkj6gry14WhLRJg5YhKXwuVgpCSTn
+toXfOYrfPit3CeG6Zs+Uv8kVWuRiCXhzLSa5KK+em1Qf30qVhPPBfgM1JSEZu/Iu
+NBICAwQbrbCTFIfwIQw5fq49EvcBcrYuB3mgOUYQ5sQhOs3MrUj2VYMtcBJQ02Q+
+xwmEWSHver4AzqlkoNesRxhTCZ10MCbe/VnQQapGFizKcPNMcUrXuS7wSZN1HkBa
+qQu27Sw4FHETg2S6WyP+yPkEto9gw9I2AR+9+CZBivw/FTwbeXViFmy6bJR5vlrG
+WiQ/4mVSqjTLUYSmDT21aDCEqKGP+Q0l1cYX5NN6
+=IsJ0
+-----END PGP MESSAGE-----