diff --git a/pmb/config/__init__.py b/pmb/config/__init__.py
index 30a96775..d41a8522 100644
--- a/pmb/config/__init__.py
+++ b/pmb/config/__init__.py
@@ -66,9 +66,7 @@ defaults = {
     "aports": "$WORK/cache_git/pmaports",
     "ccache_size": "5G",
     "is_default_channel": True,
-    # aes-xts-plain64 would be better, but this is not supported on LineageOS
-    # kernel configs
-    "cipher": "aes-cbc-plain64",
+    "cipher": "aes-xts-plain64",
     "config": os.path.expanduser("~") + "/.config/pmbootstrap.cfg",
     "device": "qemu-amd64",
     "extra_packages": "none",
@@ -191,6 +189,7 @@ necessary_kconfig_options = {
             "ANDROID_PARANOID_NETWORK": False,
             "BLK_DEV_INITRD": True,
             "CGROUPS": True,
+            "CRYPTO_XTS": True,
             "DEVTMPFS": True,
             "DM_CRYPT": True,
             "EXT4_FS": True,
diff --git a/test/testdata/kconfig_check/bad-array-missing-some-options b/test/testdata/kconfig_check/bad-array-missing-some-options
index c0905332..e6581d20 100644
--- a/test/testdata/kconfig_check/bad-array-missing-some-options
+++ b/test/testdata/kconfig_check/bad-array-missing-some-options
@@ -29,6 +29,7 @@ CONFIG_SYSVIPC=y
 CONFIG_VT=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_LBDAF=y
+CONFIG_CRYPTO_XTS=y
 CONFIG_EXT4_FS=y
 CONFIG_SQUASHFS=y
 CONFIG_SQUASHFS_XZ=y
diff --git a/test/testdata/kconfig_check/bad-missing-required-option b/test/testdata/kconfig_check/bad-missing-required-option
index b2eff871..41efc846 100644
--- a/test/testdata/kconfig_check/bad-missing-required-option
+++ b/test/testdata/kconfig_check/bad-missing-required-option
@@ -30,3 +30,4 @@ CONFIG_DM_CRYPT=y
 CONFIG_VT=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_LBDAF=y
+CONFIG_CRYPTO_XTS=y
diff --git a/test/testdata/kconfig_check/bad-wrong-option-set b/test/testdata/kconfig_check/bad-wrong-option-set
index 2abe5a93..b87b31b7 100644
--- a/test/testdata/kconfig_check/bad-wrong-option-set
+++ b/test/testdata/kconfig_check/bad-wrong-option-set
@@ -29,5 +29,6 @@ CONFIG_SYSVIPC=y
 CONFIG_VT=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_LBDAF=y
+CONFIG_CRYPTO_XTS=y
 ### here's one wrong option set:
 ANDROID_PARANOID_NETWORK=y
diff --git a/test/testdata/kconfig_check/good b/test/testdata/kconfig_check/good
index 2f0f91fb..7ce8144b 100644
--- a/test/testdata/kconfig_check/good
+++ b/test/testdata/kconfig_check/good
@@ -29,6 +29,7 @@ CONFIG_SYSVIPC=y
 CONFIG_VT=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_LBDAF=y
+CONFIG_CRYPTO_XTS=y
 ### here's one explicitely disabled:
 # ANDROID_PARANOID_NETWORK is not set
 ### here's one set to module:
diff --git a/test/testdata/kconfig_check/good-anbox b/test/testdata/kconfig_check/good-anbox
index c3cae03d..3643a3eb 100644
--- a/test/testdata/kconfig_check/good-anbox
+++ b/test/testdata/kconfig_check/good-anbox
@@ -29,6 +29,7 @@ CONFIG_SYSVIPC=y
 CONFIG_VT=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_LBDAF=y
+CONFIG_CRYPTO_XTS=y
 CONFIG_EXT4_FS=y
 CONFIG_SQUASHFS=y
 CONFIG_SQUASHFS_XZ=y