diff --git a/crypto/src/e2e_identity/identity.rs b/crypto/src/e2e_identity/identity.rs
index 79b7a0c02a..dfbb6e6ffd 100644
--- a/crypto/src/e2e_identity/identity.rs
+++ b/crypto/src/e2e_identity/identity.rs
@@ -86,7 +86,7 @@ impl MlsCentral {
 impl MlsConversation {
     fn get_device_identities(&self, device_ids: &[ClientId]) -> CryptoResult<Vec<WireIdentity>> {
         if device_ids.is_empty() {
-            return Err(CryptoError::ImplementationError);
+            return Err(CryptoError::ConsumerError);
         }
         self.members()
             .into_iter()
@@ -97,7 +97,7 @@ impl MlsConversation {
 
     fn get_user_identities(&self, user_ids: &[String]) -> CryptoResult<HashMap<String, Vec<WireIdentity>>> {
         if user_ids.is_empty() {
-            return Err(CryptoError::ImplementationError);
+            return Err(CryptoError::ConsumerError);
         }
         let user_ids = user_ids.iter().map(|uid| uid.as_bytes()).collect::<Vec<_>>();
         self.members()
@@ -191,7 +191,7 @@ pub mod tests {
                     );
 
                     let invalid = alice_android_central.get_device_identities(&id, &[]).await;
-                    assert!(matches!(invalid.unwrap_err(), CryptoError::ImplementationError));
+                    assert!(matches!(invalid.unwrap_err(), CryptoError::ConsumerError));
                 })
             },
         )
@@ -311,7 +311,7 @@ pub mod tests {
 
                     // Invalid usage
                     let invalid = alice_android_central.get_user_identities(&id, &[]).await;
-                    assert!(matches!(invalid.unwrap_err(), CryptoError::ImplementationError));
+                    assert!(matches!(invalid.unwrap_err(), CryptoError::ConsumerError));
                 })
             },
         )
diff --git a/crypto/src/error.rs b/crypto/src/error.rs
index 75b004b2d5..5d7d67dcd4 100644
--- a/crypto/src/error.rs
+++ b/crypto/src/error.rs
@@ -70,6 +70,9 @@ pub enum CryptoError {
     /// We have done something terribly wrong
     #[error("We have done something terribly wrong and it needs to be fixed")]
     ImplementationError,
+    /// Tried to insert an already existing CredentialBundle
+    #[error("Tried to insert an already existing CredentialBundle")]
+    CredentialBundleConflict,
     /// The consumer of this library has misused it
     #[error("The consumer of this library has misused it")]
     ConsumerError,
diff --git a/crypto/src/mls/client/identities.rs b/crypto/src/mls/client/identities.rs
index 4c174a864a..c01eb8da45 100644
--- a/crypto/src/mls/client/identities.rs
+++ b/crypto/src/mls/client/identities.rs
@@ -52,7 +52,7 @@ impl ClientIdentities {
             Some(cbs) => {
                 let already_exists = !cbs.insert(cb);
                 if already_exists {
-                    return Err(CryptoError::ImplementationError);
+                    return Err(CryptoError::CredentialBundleConflict);
                 }
             }
             None => {
@@ -204,7 +204,10 @@ pub mod tests {
                     let cb = central.new_credential_bundle(&case).await;
                     let client = central.mls_client.as_mut().unwrap();
                     let push = client.identities.push_credential_bundle(case.signature_scheme(), cb);
-                    assert!(push.is_err());
+                    assert!(matches!(
+                        push.unwrap_err(),
+                        crate::CryptoError::CredentialBundleConflict
+                    ));
                 })
             })
             .await
diff --git a/crypto/src/mls/client/mod.rs b/crypto/src/mls/client/mod.rs
index dcc1081959..5286c596c7 100644
--- a/crypto/src/mls/client/mod.rs
+++ b/crypto/src/mls/client/mod.rs
@@ -27,6 +27,7 @@ use crate::{
         CryptoError, CryptoResult, MlsCentral, MlsCiphersuite, MlsCredentialType, MlsError,
     },
 };
+use core_crypto_keystore::CryptoKeystoreError;
 use openmls::prelude::{Credential, CredentialType};
 use openmls_basic_credential::SignatureKeyPair;
 use openmls_traits::{crypto::OpenMlsCrypto, types::SignatureScheme, OpenMlsCryptoProvider};
@@ -360,9 +361,10 @@ impl Client {
 
         let id = id.unwrap_or_else(|| self.id());
 
+        let credential = cb.credential.tls_serialize_detached().map_err(MlsError::from)?;
         let credential = MlsCredential {
             id: id.clone().into(),
-            credential: cb.credential.tls_serialize_detached().map_err(MlsError::from)?,
+            credential,
             created_at: 0,
         };
         let created_at = credential.insert(&mut conn).await?;
@@ -373,7 +375,10 @@ impl Client {
             cb.signature_key.tls_serialize_detached().map_err(MlsError::from)?,
             id.clone().into(),
         );
-        sign_kp.save(&mut conn).await?;
+        sign_kp.save(&mut conn).await.map_err(|e| match e {
+            CryptoKeystoreError::AlreadyExists => CryptoError::CredentialBundleConflict,
+            _ => e.into(),
+        })?;
 
         // set the creation date of the signature keypair which is the same for the CredentialBundle
         cb.created_at = created_at;