diff --git a/AGENT.md b/AGENT.md
index 8dc9766..e7ada95 100644
--- a/AGENT.md
+++ b/AGENT.md
@@ -67,7 +67,7 @@ Config files use `{PLACEHOLDER}` syntax. The script substitutes values at deploy
 | File | Placeholders |
 |------|-------------|
 | `config/caddy/Caddyfile` | `{DOMAIN}`, `{TLS_EMAIL}` |
-| `config/authelia/configuration.yml` | `{DOMAIN}`, `{JWT_SECRET}`, `{SESSION_SECRET}`, `{SMTP_HOST}`, `{SMTP_PORT}`, `{SMTP_USER}`, `{SMTP_PASS}` |
+| `config/authelia/configuration.yml` | `{DOMAIN}`, `{JWT_SECRET}`, `{SESSION_SECRET}`, `{STORAGE_ENCRYPTION_KEY}`, `{SMTP_HOST}`, `{SMTP_PORT}`, `{SMTP_USER}`, `{SMTP_PASS}` |
 | `config/authelia/users_database.yml` | `{ADMIN_PASSWORD_HASH}`, `{TLS_EMAIL}` |
 | `compose/stack.yaml` | `{AUTHELIA_SECRET}` (same as `SESSION_SECRET`) |
 
@@ -85,6 +85,7 @@ SMTP_USER=post@nextwks.eu
 SMTP_PASS=<prompted>
 JWT_SECRET=<auto-generated>
 SESSION_SECRET=<auto-generated>
+STORAGE_ENCRYPTION_KEY=<auto-generated>
 ADMIN_PASSWORD_HASH=<bcrypt hash>
 ```
 
diff --git a/config/authelia/configuration.yml b/config/authelia/configuration.yml
index 19fdf28..94a6bc7 100644
--- a/config/authelia/configuration.yml
+++ b/config/authelia/configuration.yml
@@ -9,8 +9,6 @@ log:
 
 theme: dark
 
-certificates_directory: /config/certs/
-
 jwt_secret: {JWT_SECRET}
 
 default_redirection_url: https://app.{DOMAIN}/
@@ -115,6 +113,7 @@ regulation:
   ban_time: 5m
 
 storage:
+  encryption_key: {STORAGE_ENCRYPTION_KEY}
   local:
     path: /data/db.sqlite
 
diff --git a/tools/nextwks.sh b/tools/nextwks.sh
index 33a2913..a8e38b0 100755
--- a/tools/nextwks.sh
+++ b/tools/nextwks.sh
@@ -240,8 +240,10 @@ if [ "$MODE" != "update" ]; then
     # Authelia config — preserve existing secrets if present
     JWT_SECRET="${JWT_SECRET:-$(openssl rand -hex 32)}"
     SESSION_SECRET="${SESSION_SECRET:-$(openssl rand -hex 32)}"
+    STORAGE_ENCRYPTION_KEY="${STORAGE_ENCRYPTION_KEY:-$(openssl rand -hex 32)}"
     sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{JWT_SECRET}|$JWT_SECRET|g" \
         -e "s|{SESSION_SECRET}|$SESSION_SECRET|g" \
+        -e "s|{STORAGE_ENCRYPTION_KEY}|$STORAGE_ENCRYPTION_KEY|g" \
         -e "s|{SMTP_HOST}|${SMTP_HOST:-smtp.openxchange.eu}|g" \
         -e "s|{SMTP_PORT}|${SMTP_PORT:-587}|g" \
         -e "s|{SMTP_USER}|${SMTP_USER:-post@nextwks.eu}|g" \
@@ -264,11 +266,12 @@ if [ "$MODE" != "update" ]; then
 
     # Persist generated secrets so --destroy is idempotent
     if [ -f "$BACKUP_DIR/.env" ]; then
-        maybe_sudo sed -i "/^JWT_SECRET=/d; /^SESSION_SECRET=/d; /^ADMIN_PASSWORD_HASH=/d" "$BACKUP_DIR/.env" 2>/dev/null || true
+        maybe_sudo sed -i "/^JWT_SECRET=/d; /^SESSION_SECRET=/d; /^STORAGE_ENCRYPTION_KEY=/d; /^ADMIN_PASSWORD_HASH=/d" "$BACKUP_DIR/.env" 2>/dev/null || true
     fi
     # Quote values to protect $ signs (bcrypt hashes, etc.) when sourcing
     maybe_sudo bash -c "echo \"JWT_SECRET='$JWT_SECRET'\" >> '$BACKUP_DIR/.env'"
     maybe_sudo bash -c "echo \"SESSION_SECRET='$SESSION_SECRET'\" >> '$BACKUP_DIR/.env'"
+    maybe_sudo bash -c "echo \"STORAGE_ENCRYPTION_KEY='$STORAGE_ENCRYPTION_KEY'\" >> '$BACKUP_DIR/.env'"
     [ -n "$ADMIN_PASSWORD_HASH" ] && maybe_sudo bash -c "echo \"ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'\" >> '$BACKUP_DIR/.env'"
     maybe_sudo chmod 600 "$BACKUP_DIR/.env"
 fi