diff --git a/kubernetes/seed/paperless/objectstore.yaml b/kubernetes/seed/paperless/objectstore.yaml
index f8921c72..ed646335 100644
--- a/kubernetes/seed/paperless/objectstore.yaml
+++ b/kubernetes/seed/paperless/objectstore.yaml
@@ -21,10 +21,12 @@ spec:
       region:
         name: hetzner-s3-creds
         key: REGION
+    # No `encryption: AES256` (SSE-S3): Hetzner Object Storage supports
+    # only SSE-C, which the barman-cloud plugin can't use (cnpg
+    # plugin-barman-cloud #646). At-rest encryption is therefore not
+    # available here; transit is TLS and the bucket is private.
     wal:
       compression: gzip
-      encryption: AES256
     data:
       compression: gzip
-      encryption: AES256
   retentionPolicy: "30d"