diff --git a/kube/deploy/core/storage/rook-ceph/app/hr.yaml b/kube/deploy/core/storage/rook-ceph/app/hr.yaml
index 62898f94..a97d3664 100644
--- a/kube/deploy/core/storage/rook-ceph/app/hr.yaml
+++ b/kube/deploy/core/storage/rook-ceph/app/hr.yaml
@@ -34,6 +34,7 @@ spec:
       enableCSIHostNetwork: true
       # enableCSIEncryption: true
       enableCSIEncryption: false # TODO: disable for now till needed, and key management is decided
+      cephFSKernelMountOptions: "ms_mode=secure" # needed for mounting CephFS on a cluster with network encryption enabled
       enableMetadata: true # I love my verbosity
       csiAddons: # for RBD NodeLoss failover
         enabled: true