diff --git a/expected/toast_extended_storage.out b/expected/toast_extended_storage.out
index 8db49f5d..6400491e 100644
--- a/expected/toast_extended_storage.out
+++ b/expected/toast_extended_storage.out
@@ -77,4 +77,27 @@ UPDATE indtoasttest SET cnt = cnt +1, f1 = f1||'' RETURNING substring(indtoastte
 
 UPDATE indtoasttest SET  f2 = '+'||f2||'-' ;
 DROP TABLE indtoasttest;
+-- Test substr with toasted externalized bytea values
+CREATE TABLE toasttest(t bytea STORAGE EXTERNAL) using tde_heap_basic;
+INSERT INTO toasttest VALUES (decode(repeat('1234567890',10000), 'escape'));
+SET bytea_output = 'escape';
+SELECT substring(t, 1, 10) FROM toasttest;
+ substring  
+------------
+ 1234567890
+(1 row)
+
+SELECT substring(t, 50001, 10) FROM toasttest;
+ substring  
+------------
+ 1234567890
+(1 row)
+
+SELECT substring(t, 99991) FROM toasttest;
+ substring  
+------------
+ 1234567890
+(1 row)
+
+DROP TABLE toasttest;
 DROP EXTENSION pg_tde;
diff --git a/sql/toast_extended_storage.sql b/sql/toast_extended_storage.sql
index bcea028a..86aba3e4 100644
--- a/sql/toast_extended_storage.sql
+++ b/sql/toast_extended_storage.sql
@@ -35,4 +35,15 @@ UPDATE indtoasttest SET  f2 = '+'||f2||'-' ;
 
 DROP TABLE indtoasttest;
 
+-- Test substr with toasted externalized bytea values
+CREATE TABLE toasttest(t bytea STORAGE EXTERNAL) using tde_heap_basic;
+INSERT INTO toasttest VALUES (decode(repeat('1234567890',10000), 'escape'));
+
+SET bytea_output = 'escape';
+SELECT substring(t, 1, 10) FROM toasttest;
+SELECT substring(t, 50001, 10) FROM toasttest;
+SELECT substring(t, 99991) FROM toasttest;
+
+DROP TABLE toasttest;
+
 DROP EXTENSION pg_tde;
diff --git a/src16/access/pg_tdetoast.c b/src16/access/pg_tdetoast.c
index 6b4d45d5..817a2e86 100644
--- a/src16/access/pg_tdetoast.c
+++ b/src16/access/pg_tdetoast.c
@@ -812,7 +812,7 @@ tdeheap_fetch_toast_slice(Relation toastrel, Oid valueid, int32 attrsize,
 		}
 		/* Decrypt the data chunk by chunk here */
 
-		PG_TDE_DECRYPT_DATA(iv_prefix, (curchunk * TOAST_MAX_CHUNK_SIZE - sliceoffset) + encrypt_offset,
+		PG_TDE_DECRYPT_DATA(iv_prefix, (curchunk * TOAST_MAX_CHUNK_SIZE) + encrypt_offset,
 					chunkdata + chcpystrt,
 					(chcpyend - chcpystrt) + 1,
 					decrypted_data, key);
diff --git a/src17/access/pg_tdetoast.c b/src17/access/pg_tdetoast.c
index 505b0fc8..48b30aea 100644
--- a/src17/access/pg_tdetoast.c
+++ b/src17/access/pg_tdetoast.c
@@ -812,7 +812,7 @@ tdeheap_fetch_toast_slice(Relation toastrel, Oid valueid, int32 attrsize,
 		}
 		/* Decrypt the data chunk by chunk here */
 
-		PG_TDE_DECRYPT_DATA(iv_prefix, (curchunk * TOAST_MAX_CHUNK_SIZE - sliceoffset) + encrypt_offset,
+		PG_TDE_DECRYPT_DATA(iv_prefix, (curchunk * TOAST_MAX_CHUNK_SIZE) + encrypt_offset,
 					chunkdata + chcpystrt,
 					(chcpyend - chcpystrt) + 1,
 					decrypted_data, key);