diff --git a/src/lib/views/Settings.svelte b/src/lib/views/Settings.svelte
index 5707307..3ccf708 100644
--- a/src/lib/views/Settings.svelte
+++ b/src/lib/views/Settings.svelte
@@ -195,6 +195,7 @@
       upload_recording: false,
       trigger_on_finalize: true,
       allow_plaintext_lan: false,
+      encrypt_before_upload: false,
     };
   }
   function setKind(k: SyncKind) {
@@ -570,6 +571,15 @@
             ><input type="checkbox" bind:checked={form.allow_plaintext_lan} /> Allow plaintext http for
             a LAN address (not recommended)</label
           >
+          <label class="row small">
+            <input
+              type="checkbox"
+              bind:checked={form.encrypt_before_upload}
+              disabled={!vault?.unlocked}
+            />
+            Encrypt before upload (destination stores only ciphertext)
+            {#if !vault?.unlocked}<span class="muted">— requires an unlocked vault</span>{/if}
+          </label>
           <div class="actions">
             <button onclick={testConnection}>Test connection</button>
             <button class="primary" onclick={addTarget} disabled={!form.name || !form.base_url}