diff --git a/internal/version/version.go b/internal/version/version.go
index fbdf783..9d9d4f2 100644
--- a/internal/version/version.go
+++ b/internal/version/version.go
@@ -7,7 +7,7 @@ import (
 )
 
 // The version in the current branch
-var Version = "1.8.7"
+var Version = "1.8.8"
 
 // If this is "" (empty string) then it means that it is a final release.
 // Otherwise, this is a pre-release e.g. "dev", "beta", "rc1", etc.
diff --git a/model/headers/headers_test.go b/model/headers/headers_test.go
index e2d52fe..a7f8174 100644
--- a/model/headers/headers_test.go
+++ b/model/headers/headers_test.go
@@ -294,7 +294,8 @@ func TestReEncryptedHeader(t *testing.T) {
 	if err != nil {
 		panic(err)
 	}
-	if fmt.Sprintf("%v", header) != "&{[99 114 121 112 116 52 103 104] 1 1 [{[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] [0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] 108 0 <nil> {65564 {0} 0 [58 52 140 253 170 28 13 219 92 105 115 137 71 195 249 252 122 199 180 1 92 81 30 102 15 185 66 179 83 189 234 57]}}]}" {
+	if fmt.Sprintf("%v", header) != "&{[99 114 121 112 116 52 103 104] 1 1 [{[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] [0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] 108 0 <nil> {65564 {0} 0 [111 194 187 210 222 31 213 211 134 204 70 51 56 197 11 150 188 141 28 253 188 188 76 243 7 143 50 179 45 172 135 132]}}]}" {
+		t.Error(header)
 		t.Fail()
 	}
 }
diff --git a/streaming/in.go b/streaming/in.go
index d7ace96..46d53fc 100644
--- a/streaming/in.go
+++ b/streaming/in.go
@@ -155,6 +155,12 @@ func (c *crypt4GHInternalReader) ensureBuffer() (err error) {
 		toSkip := int(segmentOffset) - bufferOffset
 		_ = c.buffer.Next(toSkip)
 	}
+	if c.buffer.Len() == 0 {
+		// If we have already read everything, signal so (we might see fillBuffer
+		// succeeding to put content in but us having already seen everything in
+		// the buffer)
+		return io.EOF
+	}
 
 	return nil
 }
diff --git a/streaming/streaming_test.go b/streaming/streaming_test.go
index dd54475..4ada167 100644
--- a/streaming/streaming_test.go
+++ b/streaming/streaming_test.go
@@ -43,6 +43,41 @@ YzRnaC12MQAGc2NyeXB0ABQAAAAA2l23+H3w2F3/Zylx5Gs2CwARY2hhY2hhMjBfcG9seTEzMDUAPOdx
 -----END CRYPT4GH PRIVATE KEY-----
 `
 
+func TestDecrypt(t *testing.T) {
+	readerSecretKey, err := keys.ReadPrivateKey(strings.NewReader(crypt4ghX25519Sec), []byte("password"))
+	if err != nil {
+		t.Error(err)
+	}
+
+	inFile, err := os.Open("../test/sample.txt.enc")
+	if err != nil {
+		t.Error(err)
+	}
+
+	reader, err := NewCrypt4GHReader(inFile, readerSecretKey, nil)
+	if err != nil {
+		t.Error(err)
+	}
+
+	decBytes, err := io.ReadAll(reader)
+	if err != nil {
+		t.Error(err)
+	}
+
+	refFile, err := os.Open("../test/sample.txt")
+	if err != nil {
+		t.Error(err)
+	}
+	refBytes, err := io.ReadAll(refFile)
+	if err != nil {
+		t.Error(err)
+	}
+
+	if !bytes.Equal(decBytes, refBytes) {
+		t.Fail()
+	}
+}
+
 func TestReencryption(t *testing.T) {
 	tests := []struct {
 		name    string
@@ -388,8 +423,8 @@ func TestGetHeader(t *testing.T) {
 		t.Error(err)
 	}
 	header := hex.EncodeToString(reader.GetHeader())
-	if header != "637279707434676801000000010000006c000000000000005ee4b32a4b0fb53dc04dcb02aea9d258afd07736e13522ccaaf4077e643c8d1b9ed06c98c3183938aec96dd7b39258b80c4291ef23d4f16a4a35f52f95a25d7b6121d9646c94994c7cacfe3c98d4cb8122213b2475909fdc1e16f322e57095129cd87a6a" {
-		t.Error()
+	if header != "637279707434676801000000010000006c00000000000000fcb2dcc7f1a915f30378b83de132bcaff3dba5ae68ac4c1b7fdaeb2c6ce9ca22aeb9f2121fce004f7d9069496804a55b9b376587000b921b33b18f8edad2db3b0c9f6bbd793be69592720710def70ca27451f4aa51d5ae7510c61f634a8d397f0de65630" {
+		t.Error(header)
 	}
 	readByte, err := reader.ReadByte()
 	if err != nil {
diff --git a/test/sample.txt.enc b/test/sample.txt.enc
index e689330..2a33012 100644
Binary files a/test/sample.txt.enc and b/test/sample.txt.enc differ