diff --git a/prebuilt/common/etc/init/bliss-ssh.rc b/prebuilt/common/etc/init/bliss-ssh.rc
index edf3863..f3613c3 100644
--- a/prebuilt/common/etc/init/bliss-ssh.rc
+++ b/prebuilt/common/etc/init/bliss-ssh.rc
@@ -1,3 +1,3 @@
 on post-fs-data
-    mkdir /data/ssh 0750 root shell
+    mkdir /data/ssh 0750 root shell encryption=Require
     mkdir /data/ssh/empty 0600 root shell
diff --git a/prebuilt/common/etc/init/bliss-updates.rc b/prebuilt/common/etc/init/bliss-updates.rc
index eba752c..b4143b3 100644
--- a/prebuilt/common/etc/init/bliss-updates.rc
+++ b/prebuilt/common/etc/init/bliss-updates.rc
@@ -1,4 +1,4 @@
 on post-fs-data
     # Create an additional OTA package directory that unlike /data/ota_package
     # will not be touched by GmsCore.
-    mkdir /data/bliss_updates 0770 system cache
+    mkdir /data/bliss_updates 0770 system cache encryption=Require