diff --git a/src/Tgstation.Server.Host/Setup/SetupWizard.cs b/src/Tgstation.Server.Host/Setup/SetupWizard.cs
index 92b3d53c42..35024c47bb 100644
--- a/src/Tgstation.Server.Host/Setup/SetupWizard.cs
+++ b/src/Tgstation.Server.Host/Setup/SetupWizard.cs
@@ -501,16 +501,16 @@ namespace Tgstation.Server.Host.Setup
 				}
 				while (true);
 
-				bool useWinAuth;
+				var useWinAuth = false;
+				var encrypt = false;
 				if (databaseConfiguration.DatabaseType == DatabaseType.SqlServer && platformIdentifier.IsWindows)
 				{
 					var defaultResponse = serverAddressEntry?.AddressList.Any(IPAddress.IsLoopback) ?? false
 						? (bool?)true
 						: null;
 					useWinAuth = await PromptYesNo("Use Windows Authentication?", defaultResponse, cancellationToken);
+					encrypt = await PromptYesNo("Use encrypted connection?", false, cancellationToken);
 				}
-				else
-					useWinAuth = false;
 
 				await console.WriteAsync(null, true, cancellationToken);
 
@@ -566,6 +566,8 @@ namespace Tgstation.Server.Host.Setup
 								csb.Password = password;
 							}
 
+							csb.Encrypt = encrypt;
+
 							CreateTestConnection(csb.ConnectionString);
 							csb.InitialCatalog = databaseName;
 							databaseConfiguration.ConnectionString = csb.ConnectionString;
diff --git a/tests/Tgstation.Server.Host.Tests/Setup/TestSetupWizard.cs b/tests/Tgstation.Server.Host.Tests/Setup/TestSetupWizard.cs
index 7ad15d9ad0..c60d7308c2 100644
--- a/tests/Tgstation.Server.Host.Tests/Setup/TestSetupWizard.cs
+++ b/tests/Tgstation.Server.Host.Tests/Setup/TestSetupWizard.cs
@@ -181,6 +181,8 @@ namespace Tgstation.Server.Host.Setup.Tests
 				"no",
 				//test winauth
 				"yes",
+				// encrypt
+				"YES",
 				//sql server will always fail so reconfigure with maria
 				nameof(DatabaseType.MariaDB),
 				"127.0.0.1",