diff --git a/backend/windmill-worker/src/mssql_executor.rs b/backend/windmill-worker/src/mssql_executor.rs
index 7f5ec7c116..7e4ccd2958 100644
--- a/backend/windmill-worker/src/mssql_executor.rs
+++ b/backend/windmill-worker/src/mssql_executor.rs
@@ -5,7 +5,9 @@ use regex::Regex;
 use serde::Deserialize;
 use serde_json::value::RawValue;
 use serde_json::{Map, Value};
-use tiberius::{AuthMethod, Client, ColumnData, Config, FromSqlOwned, Query, Row, SqlBrowser};
+use tiberius::{
+    AuthMethod, Client, ColumnData, Config, EncryptionLevel, FromSqlOwned, Query, Row, SqlBrowser,
+};
 use tokio::net::TcpStream;
 use tokio_util::compat::TokioAsyncWriteCompatExt;
 use uuid::Uuid;
@@ -39,6 +41,7 @@ struct MssqlDatabase {
     trust_cert: Option<bool>,
     #[serde(default, deserialize_with = "empty_as_none")]
     ca_cert: Option<String>,
+    encrypt: Option<bool>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -146,6 +149,12 @@ pub async fn do_mssql(
         tracing::info!("MSSQL: using provided CA certificate for trust");
     }
 
+    config.encryption(if database.encrypt.unwrap_or(true) {
+        EncryptionLevel::Required
+    } else {
+        EncryptionLevel::NotSupported
+    });
+
     let tcp = if use_instance_name {
         TcpStream::connect_named(&config).await.map_err(to_anyhow)? // named instance
     } else {