diff --git a/testing/controller/controller.go b/testing/controller/controller.go
index f5295b3837..de3e73c6de 100644
--- a/testing/controller/controller.go
+++ b/testing/controller/controller.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/hashicorp/boundary/internal/cmd/config"
 	"github.com/hashicorp/boundary/internal/servers/controller"
+	wrapping "github.com/hashicorp/go-kms-wrapping"
 )
 
 func getOpts(opt ...Option) (*controller.TestControllerOpts, error) {
@@ -46,6 +47,7 @@ type option struct {
 	setDefaultAuthMethodId       bool
 	setDefaultLoginName          bool
 	setDefaultPassword           bool
+	setRecoveryKms               bool
 }
 
 type Option func(*option) error
@@ -127,6 +129,14 @@ func WithDefaultPassword(pw string) Option {
 	}
 }
 
+func WithRecoveryKms(wrapper wrapping.Wrapper) Option {
+	return func(c *option) error {
+		c.setRecoveryKms = true
+		c.tcOptions.RecoveryKms = wrapper
+		return nil
+	}
+}
+
 // NewTestController blocks until a new TestController is created, returns the url for the TestController and a function
 // that can be called to tear down the controller after it has been used for testing.
 func NewTestController(t *testing.T, opt ...Option) *TestController {