diff --git a/machines/rana/disko.nix b/machines/rana/disko.nix
index fbc082f..5153edd 100644
--- a/machines/rana/disko.nix
+++ b/machines/rana/disko.nix
@@ -53,6 +53,9 @@ in
       zroot = {
         type = "zpool";
         rootFsOptions = {
+          encryption = "aes-256-gcm";
+          keyformat = "passphrase";
+          keylocation = "file:///tmp/secret.key";
           mountpoint = "none";
           compression = "lz4";
           acltype = "posixacl";