diff --git a/apps/authentik/templates/postgresql.yaml b/apps/authentik/templates/postgresql.yaml
index 283d864..058bc0d 100644
--- a/apps/authentik/templates/postgresql.yaml
+++ b/apps/authentik/templates/postgresql.yaml
@@ -23,9 +23,13 @@ spec:
         key: AWS_REGION
     wal:
       compression: gzip
+      # Require Backblaze's S3-compatible SSE-B2 encryption rather than
+      # relying only on the bucket's default encryption policy.
+      encryption: AES256
       maxParallel: 2
     data:
       compression: gzip
+      encryption: AES256
       jobs: 2
   # Backblaze implements the S3 API but does not require every optional AWS
   # checksum behavior. These settings avoid incompatible optional checksums.