diff --git a/cdk/lib/app-stack.ts b/cdk/lib/app-stack.ts
index 05462de8..ba25fde8 100644
--- a/cdk/lib/app-stack.ts
+++ b/cdk/lib/app-stack.ts
@@ -55,6 +55,7 @@ export class AppStack extends cdk.Stack {
     const db = new rds.DatabaseInstance(this, 'RdsInstance', {
       engine: rds.DatabaseInstanceEngine.mysql({ version: rds.MysqlEngineVersion.VER_8_0 }),
       instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
+      storageEncrypted: true, // NOTE: It defaults to true, but SonarQube doesn't seem to know that
       credentials: rds.Credentials.fromGeneratedSecret('nabu'),
       databaseName: 'nabu',
       vpc,