diff --git a/kmail/kmreaderwin.cpp b/kmail/kmreaderwin.cpp
index 1bd31129..a8153393 100644
--- a/kmail/kmreaderwin.cpp
+++ b/kmail/kmreaderwin.cpp
@@ -1401,8 +1401,6 @@ void KMReaderWin::updateReaderWin()
 {
   if (!mMsgDisplay) return;
 
-  mViewer->setOnlyLocalReferences(!htmlLoadExternal());
-
   htmlWriter()->reset();
 
   KMFolder* folder = 0;
@@ -1565,6 +1563,7 @@ void KMReaderWin::parseMsg(KMMessage* aMsg)
   //  - this can only be done *after* calling parseObjectTree()
   KMMsgEncryptionState encryptionState = mRootNode->overallEncryptionState();
   KMMsgSignatureState  signatureState  = mRootNode->overallSignatureState();
+  mViewer->setOnlyLocalReferences(!htmlLoadExternal());
   // Don't crash when switching message while GPG passphrase entry dialog is shown #53185
   if (aMsg != message()) {
     displayMessage();
@@ -2490,8 +2489,19 @@ bool KMReaderWin::htmlMail()
 //-----------------------------------------------------------------------------
 bool KMReaderWin::htmlLoadExternal()
 {
-  return ((mHtmlLoadExternal && !mHtmlLoadExtOverride) ||
-          (!mHtmlLoadExternal && mHtmlLoadExtOverride));
+	if (!mRootNode)
+	{
+		return mHtmlLoadExtOverride;
+	}
+
+	// when displaying an encrypted message, only load external resources on explicit request
+	if (mRootNode->overallEncryptionState() != KMMsgNotEncrypted)
+	{
+		return mHtmlLoadExtOverride;
+	}
+
+	return ((mHtmlLoadExternal && !mHtmlLoadExtOverride) ||
+	        (!mHtmlLoadExternal && mHtmlLoadExtOverride));
 }