Okay so it basically solved itself by now: I tried to enter the passphrase many times. Then I used my phone as always and then I shut down. After reboot it showed a screen with an option to change the alternative password. Great!
I think I might have failed to enter the passphrase correctly because it only accepts 16 characters and iirc the password I had was longer than that. Actually what I thought was my alternative password was shorter than 16 characters.
Follow-up question: "Alternative password has been set as the decryption password"
Another follow-up: now the data on my encrypted SD card has been wiped. Not sure why this was done - the apps still work but the photos on it are just unreadable files. Great.