diff --git a/internal/cmd/base/server_test.go b/internal/cmd/base/server_test.go
index 3006709663..b0921b9a11 100644
--- a/internal/cmd/base/server_test.go
+++ b/internal/cmd/base/server_test.go
@@ -63,7 +63,7 @@ func TestServer_SetupKMSes_Purposes(t *testing.T) {
 		{
 			name: "multi purpose",
 			purposes: []string{
-				globals.KmsPurposeRoot, globals.KmsPurposeRecovery, globals.KmsPurposeWorkerAuth,
+				globals.KmsPurposeRoot, globals.KmsPurposeRecovery, globals.KmsPurposeWorkerAuth, globals.KmsPurposeDownstreamWorkerAuth,
 				globals.KmsPurposeWorkerAuthStorage, globals.KmsPurposeConfig, globals.KmsPurposeBsr,
 			},
 		},
diff --git a/internal/cmd/base/servers.go b/internal/cmd/base/servers.go
index bfa843e42f..70e4559126 100644
--- a/internal/cmd/base/servers.go
+++ b/internal/cmd/base/servers.go
@@ -569,6 +569,7 @@ func (b *Server) SetupKMSes(ctx context.Context, ui cli.Ui, config *config.Confi
 				globals.KmsPurposePreviousRoot,
 				globals.KmsPurposeConfig,
 				globals.KmsPurposeWorkerAuth,
+				globals.KmsPurposeDownstreamWorkerAuth,
 				globals.KmsPurposeWorkerAuthStorage,
 				globals.KmsPurposeBsr:
 			case globals.KmsPurposeRecovery: