diff --git a/s3_bucket.tf b/s3_bucket.tf
index 04c25d8..a066964 100644
--- a/s3_bucket.tf
+++ b/s3_bucket.tf
@@ -22,6 +22,14 @@ resource "aws_s3_bucket" "munki-bucket" {
     prevent_destroy = false
   }
 
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        sse_algorithm = "aws:kms"
+      }
+    }
+  }
+
   tags = merge(
     var.tags,
     {