diff --git a/pkg/actuators/machine/instances.go b/pkg/actuators/machine/instances.go
index a8506a33a6..ce2ae0de3c 100644
--- a/pkg/actuators/machine/instances.go
+++ b/pkg/actuators/machine/instances.go
@@ -200,11 +200,13 @@ func getBlockDeviceMappings(blockDeviceMappings []providerconfigv1.BlockDeviceMa
 	// Only support one blockDeviceMapping
 	volumeSize := blockDeviceMappings[0].EBS.VolumeSize
 	volumeType := blockDeviceMappings[0].EBS.VolumeType
+	encrypted := true
 	blockDeviceMapping := ec2.BlockDeviceMapping{
 		DeviceName: deviceName,
 		Ebs: &ec2.EbsBlockDevice{
 			VolumeSize: volumeSize,
 			VolumeType: volumeType,
+			Encrypted:  &encrypted,
 		},
 	}
 	if *volumeType == "io1" {