diff --git a/packages/server/src/controllers/assistants/index.ts b/packages/server/src/controllers/assistants/index.ts
index e4159bf3fa8..66ceab0f3d2 100644
--- a/packages/server/src/controllers/assistants/index.ts
+++ b/packages/server/src/controllers/assistants/index.ts
@@ -35,8 +35,7 @@ const createAssistant = async (req: Request, res: Response, next: NextFunction)
         const newAssistantCount = 1
         await checkUsageLimit('flows', subscriptionId, getRunningExpressApp().usageCacheManager, existingAssistantCount + newAssistantCount)
 
-        body.workspaceId = workspaceId
-        const apiResponse = await assistantsService.createAssistant(body, orgId)
+        const apiResponse = await assistantsService.createAssistant(body, orgId, workspaceId)
 
         return res.json(apiResponse)
     } catch (error) {
diff --git a/packages/server/src/services/assistants/index.ts b/packages/server/src/services/assistants/index.ts
index b6c9d539369..21ca90abb67 100644
--- a/packages/server/src/services/assistants/index.ts
+++ b/packages/server/src/services/assistants/index.ts
@@ -7,6 +7,7 @@ import { Assistant } from '../../database/entities/Assistant'
 import { Credential } from '../../database/entities/Credential'
 import { DocumentStore } from '../../database/entities/DocumentStore'
 import { Workspace } from '../../enterprise/database/entities/workspace.entity'
+import { WorkspaceService } from '../../enterprise/services/workspace.service'
 import { getWorkspaceSearchOptions } from '../../enterprise/utils/ControllerServiceUtils'
 import { InternalFlowiseError } from '../../errors/internalFlowiseError'
 import { getErrorMessage } from '../../errors/utils'
@@ -20,7 +21,37 @@ import { ASSISTANT_PROMPT_GENERATOR } from '../../utils/prompt'
 import { checkUsageLimit } from '../../utils/quotaUsage'
 import nodesService from '../nodes'
 
-const createAssistant = async (requestBody: any, orgId: string): Promise<Assistant> => {
+const findAccessibleCredential = async (credentialId: string, workspaceId: string): Promise<Credential | null> => {
+    const appServer = getRunningExpressApp()
+    const credential = await appServer.AppDataSource.getRepository(Credential).findOneBy({
+        id: credentialId,
+        workspaceId
+    })
+    if (credential) return credential
+
+    const workspaceService = new WorkspaceService()
+    const sharedItems = (await workspaceService.getSharedItemsForWorkspace(workspaceId, 'credential')) as Credential[]
+    if (sharedItems.some((item) => item.id === credentialId)) {
+        return await appServer.AppDataSource.getRepository(Credential).findOneBy({ id: credentialId })
+    }
+    return null
+}
+
+function applyAssistantCreateFields(entity: Assistant, body: any, workspaceId: string): void {
+    entity.details = body.details
+    entity.credential = body.credential
+    entity.iconSrc = body.iconSrc
+    entity.type = body.type
+    entity.workspaceId = workspaceId
+}
+
+function applyAssistantUpdateFields(entity: Assistant, details: string, body: any): void {
+    entity.details = details
+    entity.credential = body.credential
+    entity.iconSrc = body.iconSrc
+}
+
+const createAssistant = async (requestBody: any, orgId: string, workspaceId: string): Promise<Assistant> => {
     try {
         const appServer = getRunningExpressApp()
         if (!requestBody.details) {
@@ -30,7 +61,7 @@ const createAssistant = async (requestBody: any, orgId: string): Promise<Assista
 
         if (requestBody.type === 'CUSTOM') {
             const newAssistant = new Assistant()
-            Object.assign(newAssistant, requestBody)
+            applyAssistantCreateFields(newAssistant, requestBody, workspaceId)
 
             const assistant = appServer.AppDataSource.getRepository(Assistant).create(newAssistant)
             const dbResponse = await appServer.AppDataSource.getRepository(Assistant).save(assistant)
@@ -50,9 +81,7 @@ const createAssistant = async (requestBody: any, orgId: string): Promise<Assista
         }
 
         try {
-            const credential = await appServer.AppDataSource.getRepository(Credential).findOneBy({
-                id: requestBody.credential
-            })
+            const credential = await findAccessibleCredential(requestBody.credential, workspaceId)
 
             if (!credential) {
                 throw new InternalFlowiseError(StatusCodes.NOT_FOUND, `Credential ${requestBody.credential} not found`)
@@ -135,7 +164,7 @@ const createAssistant = async (requestBody: any, orgId: string): Promise<Assista
             throw new InternalFlowiseError(StatusCodes.INTERNAL_SERVER_ERROR, `Error creating new assistant - ${getErrorMessage(error)}`)
         }
         const newAssistant = new Assistant()
-        Object.assign(newAssistant, requestBody)
+        applyAssistantCreateFields(newAssistant, requestBody, workspaceId)
 
         const assistant = appServer.AppDataSource.getRepository(Assistant).create(newAssistant)
         const dbResponse = await appServer.AppDataSource.getRepository(Assistant).save(assistant)
@@ -298,11 +327,7 @@ const updateAssistant = async (assistantId: string, requestBody: any, workspaceI
         }
 
         if (assistant.type === 'CUSTOM') {
-            const body = requestBody
-            const updateAssistant = new Assistant()
-            Object.assign(updateAssistant, body)
-
-            appServer.AppDataSource.getRepository(Assistant).merge(assistant, updateAssistant)
+            applyAssistantUpdateFields(assistant, requestBody.details, requestBody)
             const dbResponse = await appServer.AppDataSource.getRepository(Assistant).save(assistant)
             return dbResponse
         }
@@ -311,9 +336,7 @@ const updateAssistant = async (assistantId: string, requestBody: any, workspaceI
             const openAIAssistantId = JSON.parse(assistant.details)?.id
             const body = requestBody
             const assistantDetails = JSON.parse(body.details)
-            const credential = await appServer.AppDataSource.getRepository(Credential).findOneBy({
-                id: body.credential
-            })
+            const credential = await findAccessibleCredential(body.credential, workspaceId)
 
             if (!credential) {
                 throw new InternalFlowiseError(StatusCodes.NOT_FOUND, `Credential ${body.credential} not found`)
@@ -376,11 +399,7 @@ const updateAssistant = async (assistantId: string, requestBody: any, workspaceI
             }
             if (savedToolResources) newAssistantDetails.tool_resources = savedToolResources
 
-            const updateAssistant = new Assistant()
-            body.details = JSON.stringify(newAssistantDetails)
-            Object.assign(updateAssistant, body)
-
-            appServer.AppDataSource.getRepository(Assistant).merge(assistant, updateAssistant)
+            applyAssistantUpdateFields(assistant, JSON.stringify(newAssistantDetails), body)
             const dbResponse = await appServer.AppDataSource.getRepository(Assistant).save(assistant)
             return dbResponse
         } catch (error) {