diff --git a/config/sync/config_ignore.settings.yml b/config/sync/config_ignore.settings.yml
index dadd50d2..b9d2ebca 100644
--- a/config/sync/config_ignore.settings.yml
+++ b/config/sync/config_ignore.settings.yml
@@ -26,3 +26,5 @@ ignored_config_entities:
   - 'leaflet_layers.map_bundle.*'
   - 'leaflet_layers.map_layer.*'
   - os2forms_forloeb.settings
+  - '# Ignore encryption key'
+  - key.key.webform.yml
diff --git a/config/sync/core.extension.yml b/config/sync/core.extension.yml
index 5d0254de..308e2f1a 100644
--- a/config/sync/core.extension.yml
+++ b/config/sync/core.extension.yml
@@ -32,6 +32,7 @@ module:
   dynamic_entity_reference: 0
   dynamic_page_cache: 0
   editor: 0
+  encrypt: 0
   entity_print: 0
   events_logging: 0
   field: 0
@@ -49,6 +50,7 @@ module:
   itkdev_openid_connect: 0
   jquery_ui: 0
   jquery_ui_datepicker: 0
+  key: 0
   key_auth: 0
   keyboard_shortcuts: 0
   lang_dropdown: 0
@@ -115,6 +117,7 @@ module:
   shortcut: 0
   simplesamlphp_auth: 0
   smtp: 0
+  sodium: 0
   switch_page_theme: 0
   syslog: 0
   system: 0
@@ -132,6 +135,7 @@ module:
   webform_attachment: 0
   webform_composite: 0
   webform_embed: 0
+  webform_encrypt: 0
   webform_entity_print: 0
   webform_entity_print_attachment: 0
   webform_migrate: 0
@@ -157,6 +161,7 @@ module:
   views: 10
   os2forms_forloeb_profile: 1000
   eu_cookie_compliance: 1001
+  os2forms_encrypt: 9999
 theme:
   bootstrap: 0
   stable: 0
diff --git a/config/sync/encrypt.profile.webform.yml b/config/sync/encrypt.profile.webform.yml
new file mode 100644
index 00000000..064032d0
--- /dev/null
+++ b/config/sync/encrypt.profile.webform.yml
@@ -0,0 +1,15 @@
+uuid: 98e9a380-a5d6-4d2a-9176-7c50a9ec7c47
+langcode: en
+status: true
+dependencies:
+  config:
+    - key.key.webform
+  module:
+    - sodium
+_core:
+  default_config_hash: 4miM8UkvV0MH9zg2WDwY6bAdADaw5mHWS4m1PaaK9iA
+id: webform
+label: Webform
+encryption_method: sodium
+encryption_key: webform
+encryption_method_configuration: {  }
diff --git a/config/sync/encrypt.settings.yml b/config/sync/encrypt.settings.yml
new file mode 100644
index 00000000..dbd39266
--- /dev/null
+++ b/config/sync/encrypt.settings.yml
@@ -0,0 +1,4 @@
+_core:
+  default_config_hash: CMyccvAuba2yH-HYmcEL0pq1Seyxzq9VHhKbQKwAWY4
+check_profile_status: true
+allow_deprecated_plugins: false
diff --git a/config/sync/key.key.webform.yml b/config/sync/key.key.webform.yml
new file mode 100644
index 00000000..50fbe8e1
--- /dev/null
+++ b/config/sync/key.key.webform.yml
@@ -0,0 +1,19 @@
+uuid: be3383e8-1b0e-4b50-989f-e132900d02a0
+langcode: en
+status: true
+dependencies: {  }
+_core:
+  default_config_hash: nIajzA6KCO8rJsAn4--2gcBgi9eW4QUjCiHRxBuXPkA
+id: webform
+label: Webform
+description: 'Encrypt webform submissions'
+key_type: encryption
+key_type_settings:
+  key_size: 256
+key_provider: config
+key_provider_settings:
+  key_value: LWD5+0klWZn48ZVs13UVHaHJYawX62PAMd3sklkKj/w=
+  base64_encoded: true
+key_input: text_field
+key_input_settings:
+  base64_encoded: true
diff --git a/config/sync/os2forms_encrypt.settings.yml b/config/sync/os2forms_encrypt.settings.yml
new file mode 100644
index 00000000..c1dfb38c
--- /dev/null
+++ b/config/sync/os2forms_encrypt.settings.yml
@@ -0,0 +1,3 @@
+_core:
+  default_config_hash: VwzMkTPurD4eXUBOO9IHEKC22bPC3nBHU3hTsU3PMsM
+enabled: 1