diff --git a/enos/modules/aws_vault/vault-instances.tf b/enos/modules/aws_vault/vault-instances.tf
index 484e32bea4..774adeca61 100644
--- a/enos/modules/aws_vault/vault-instances.tf
+++ b/enos/modules/aws_vault/vault-instances.tf
@@ -18,6 +18,10 @@ resource "aws_instance" "vault_instance" {
     },
   )
 
+  root_block_device {
+    encrypted = true
+  }
+
   metadata_options {
     http_endpoint = "enabled"
     http_tokens   = "required"