diff --git a/net/aws/src/s3sink/multipartsink.rs b/net/aws/src/s3sink/multipartsink.rs
index 5554fb09..52f72ab5 100644
--- a/net/aws/src/s3sink/multipartsink.rs
+++ b/net/aws/src/s3sink/multipartsink.rs
@@ -22,7 +22,7 @@ use aws_sdk_s3::{
         upload_part::builders::UploadPartFluentBuilder,
     },
     primitives::ByteStream,
-    types::{CompletedMultipartUpload, CompletedPart},
+    types::{CompletedMultipartUpload, CompletedPart, ServerSideEncryption},
     Client,
 };
 
@@ -30,6 +30,7 @@ use futures::future;
 use once_cell::sync::Lazy;
 use std::collections::HashMap;
 use std::convert::From;
+use std::str::FromStr;
 use std::sync::Mutex;
 use std::time::Duration;
 
@@ -105,6 +106,7 @@ struct Settings {
     key: Option<String>,
     content_type: Option<String>,
     content_disposition: Option<String>,
+    server_side_encryption: Option<String>,
     buffer_size: u64,
     access_key: Option<String>,
     secret_access_key: Option<String>,
@@ -159,6 +161,7 @@ impl Default for Settings {
             key: None,
             content_type: None,
             content_disposition: None,
+            server_side_encryption: None,
             access_key: None,
             secret_access_key: None,
             session_token: None,
@@ -358,6 +361,12 @@ impl S3Sink {
         let content_type = settings.content_type.clone();
         let content_disposition = settings.content_disposition.clone();
         let metadata = settings.to_metadata(self);
+        let server_side_encryption = match ServerSideEncryption::from_str(
+            &settings.server_side_encryption.clone().unwrap_or_default(),
+        ) {
+            Ok(v) => Some(v),
+            Err(_e) => None,
+        };
 
         client
             .create_multipart_upload()
@@ -366,6 +375,7 @@ impl S3Sink {
             .set_content_type(content_type)
             .set_content_disposition(content_disposition)
             .set_metadata(metadata)
+            .set_server_side_encryption(server_side_encryption)
     }
 
     fn create_abort_multipart_upload_request(
@@ -775,6 +785,10 @@ impl ObjectImpl for S3Sink {
                     .nick("content-disposition")
                     .blurb("Content-Disposition header to set for uploaded object")
                     .build(),
+                glib::ParamSpecString::builder("server-side-encryption")
+                    .nick("server-side-encryption")
+                    .blurb("The S3 server side encryption algorithm to use (AES256 or aws:kms)")
+                    .build(),
             ]
         });
 
@@ -888,6 +902,11 @@ impl ObjectImpl for S3Sink {
                     .get::<Option<String>>()
                     .expect("type checked upstream");
             }
+            "server-side-encryption" => {
+                settings.server_side_encryption = value
+                    .get::<Option<String>>()
+                    .expect("type checked upstream");
+            }
             _ => unimplemented!(),
         }
     }
@@ -929,6 +948,7 @@ impl ObjectImpl for S3Sink {
             "endpoint-uri" => settings.endpoint_uri.to_value(),
             "content-type" => settings.content_type.to_value(),
             "content-disposition" => settings.content_disposition.to_value(),
+            "server-side-encryption" => settings.server_side_encryption.to_value(),
             _ => unimplemented!(),
         }
     }