diff --git a/src/main/java/org/kiwiproject/ansible/vault/VaultEncryptionHelper.java b/src/main/java/org/kiwiproject/ansible/vault/VaultEncryptionHelper.java
index 583f8b9a..e9968472 100644
--- a/src/main/java/org/kiwiproject/ansible/vault/VaultEncryptionHelper.java
+++ b/src/main/java/org/kiwiproject/ansible/vault/VaultEncryptionHelper.java
@@ -70,10 +70,10 @@ public VaultEncryptionHelper(VaultConfiguration configuration) {
     private static VaultConfiguration validateAndCopyVaultConfiguration(VaultConfiguration configuration) {
         checkArgumentNotBlank(configuration.getVaultPasswordFilePath(), "vaultPasswordFilePath is required");
         checkArgument(isExistingPath(configuration.getVaultPasswordFilePath()),
-                "vault password file does not exist: {}", configuration.getVaultPasswordFilePath());
+                "vault password file does not exist: %s", configuration.getVaultPasswordFilePath());
         checkArgumentNotBlank(configuration.getAnsibleVaultPath(), "ansibleVaultPath is required");
         checkArgument(isExistingPath(configuration.getAnsibleVaultPath()),
-                "ansible-vault executable does not exist: {}", configuration.getAnsibleVaultPath());
+                "ansible-vault executable does not exist: %s", configuration.getAnsibleVaultPath());
 
         return configuration.copyOf();
     }
diff --git a/src/test/java/org/kiwiproject/ansible/vault/VaultEncryptionHelperTest.java b/src/test/java/org/kiwiproject/ansible/vault/VaultEncryptionHelperTest.java
index e2cc9c16..c24cc6d1 100644
--- a/src/test/java/org/kiwiproject/ansible/vault/VaultEncryptionHelperTest.java
+++ b/src/test/java/org/kiwiproject/ansible/vault/VaultEncryptionHelperTest.java
@@ -22,6 +22,7 @@
 import org.junit.jupiter.api.io.TempDir;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.CsvSource;
+import org.junit.jupiter.params.provider.NullAndEmptySource;
 import org.kiwiproject.base.process.ProcessHelper;
 import org.kiwiproject.collect.KiwiLists;
 import org.kiwiproject.internal.Fixtures;
@@ -87,11 +88,53 @@ void shouldNotAllowNullConfig() {
         }
 
         @Test
-        void shouldValidateVaultConfiguration() {
-            var emptyConfig = new VaultConfiguration();
+        void shouldNotAllowNullProcessHelper() {
+            assertThatIllegalArgumentException()
+                    .isThrownBy(() -> new VaultEncryptionHelper(mock(VaultConfiguration.class), null));
+        }
+
+        @ParameterizedTest
+        @NullAndEmptySource
+        void shouldValidateVaultPasswordFilePath(String vaultPasswordFilePath) {
+            var config = new VaultConfiguration();
+            config.setVaultPasswordFilePath(vaultPasswordFilePath);
+
+            assertThatIllegalArgumentException()
+                    .isThrownBy(() -> new VaultEncryptionHelper(config))
+                    .withMessage("vaultPasswordFilePath is required");
+        }
+
+        @Test
+        void shouldValidateVaultPasswordFilePathExists() {
+            var config = new VaultConfiguration();
+            config.setVaultPasswordFilePath("/almost/certainly/does/not/exist.txt");
+
+            assertThatIllegalArgumentException()
+                    .isThrownBy(() -> new VaultEncryptionHelper(config))
+                    .withMessage("vault password file does not exist: %s", config.getVaultPasswordFilePath());
+        }
+
+        @ParameterizedTest
+        @NullAndEmptySource
+        void shouldValidateAnsibleVaultPath(String ansibleVaultPath) {
+            var config = new VaultConfiguration();
+            config.setVaultPasswordFilePath(configuration.getVaultPasswordFilePath());  // passes validation
+            config.setAnsibleVaultPath(ansibleVaultPath);
+
+            assertThatIllegalArgumentException()
+                    .isThrownBy(() -> new VaultEncryptionHelper(config))
+                    .withMessage("ansibleVaultPath is required");
+        }
+
+        @Test
+        void shouldValidateAnsibleVaultPathExists() {
+            var config = new VaultConfiguration();
+            config.setVaultPasswordFilePath(configuration.getVaultPasswordFilePath());  // passes validation
+            config.setAnsibleVaultPath("/almost/certainly/does/not/exist.txt");
 
             assertThatIllegalArgumentException()
-                    .isThrownBy(() -> new VaultEncryptionHelper(emptyConfig));
+                    .isThrownBy(() -> new VaultEncryptionHelper(config))
+                    .withMessage("ansible-vault executable does not exist: %s", config.getAnsibleVaultPath());
         }
     }