diff --git a/enos/modules/aws_vault/vault-instances.tf b/enos/modules/aws_vault/vault-instances.tf
index 8ed35ce60a..0894768823 100644
--- a/enos/modules/aws_vault/vault-instances.tf
+++ b/enos/modules/aws_vault/vault-instances.tf
@@ -18,6 +18,10 @@ resource "aws_instance" "vault_instance" {
     },
   )
 
+  root_block_device {
+    encrypted = true
+  }
+
   metadata_options {
     http_endpoint = "enabled"
     http_tokens   = "required"