diff --git a/Cargo.toml b/Cargo.toml
index cae6b9d7..bbcbb2f1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -63,5 +63,6 @@ matrix-sdk = { version = "0.14", default-features = false, features = [
   "rustls-tls",
   "sqlite",
   "markdown",
+  "e2e-encryption",
 ] }
 futures-util = "0.3"
diff --git a/hive-matrix-mcp/src/client.rs b/hive-matrix-mcp/src/client.rs
index e5ea8e0a..efe73e29 100644
--- a/hive-matrix-mcp/src/client.rs
+++ b/hive-matrix-mcp/src/client.rs
@@ -9,6 +9,13 @@
 //! UIAA flow already minted the token + user/device, hive-c0re just
 //! handed us the bearer in a file. matrix-sdk's `restore_session` with
 //! a constructed `MatrixSession` skips the login flow entirely.
+//!
+//! E2EE is enabled via `with_encryption_settings(EncryptionSettings::default())`.
+//! Crypto keys are persisted in the sqlite store under `state_dir`
+//! (survives container restarts, lost on `--purge`). Cross-signing and
+//! automatic key backup are deliberately left at their defaults (disabled)
+//! for the first pass: bot accounts authenticated with a static bearer token
+//! can't bootstrap cross-signing without MSC3967 on the server side.
 
 use std::path::Path;
 
@@ -16,6 +23,7 @@ use anyhow::{Context, Result, anyhow};
 use matrix_sdk::{
     Client, SessionMeta, SessionTokens,
     authentication::matrix::MatrixSession,
+    encryption::EncryptionSettings,
     ruma::{OwnedDeviceId, OwnedUserId},
 };
 use serde::Deserialize;
@@ -108,6 +116,7 @@ pub async fn build_and_restore(
     let client = Client::builder()
         .homeserver_url(homeserver)
         .sqlite_store(state_dir, None)
+        .with_encryption_settings(EncryptionSettings::default())
         .build()
         .await
         .with_context(|| format!("build matrix client for {homeserver}"))?;
diff --git a/nix/modules/hive-matrix.nix b/nix/modules/hive-matrix.nix
index 5c8b5ba7..d147323b 100644
--- a/nix/modules/hive-matrix.nix
+++ b/nix/modules/hive-matrix.nix
@@ -403,8 +403,7 @@ in
               # LoadCredential below copies the host file into a
               # 0400 dynamic-user-owned path; tuwunel reads from there.
               registration_token_file = "/run/credentials/tuwunel.service/registration_token";
-              # E2EE disabled in initial rollout; tracked in the issue tracker.
-              allow_encryption = false;
+              allow_encryption = true;
               # Tuwunel's default suffix is " 💕" — suppress it so agent
               # display names are clean (just the agent name, no emoji).
               new_user_displayname_suffix = "";