diff --git a/packages/techdocs-common/src/stages/publish/awsS3.ts b/packages/techdocs-common/src/stages/publish/awsS3.ts
index 05ce80eaca..abfa8ddd24 100644
--- a/packages/techdocs-common/src/stages/publish/awsS3.ts
+++ b/packages/techdocs-common/src/stages/publish/awsS3.ts
@@ -70,13 +70,14 @@ export class AwsS3Publish implements PublisherBase {
     legacyPathCasing: boolean;
     logger: Logger;
     bucketRootPath: string;
+    sse?: 'aws:kms' | 'AES256';
   }) {
     this.storageClient = options.storageClient;
     this.bucketName = options.bucketName;
     this.legacyPathCasing = options.legacyPathCasing;
     this.logger = options.logger;
     this.bucketRootPath = options.bucketRootPath;
-    this.sse = sse;
+    this.sse = options.sse;
   }
 
   static fromConfig(config: Config, logger: Logger): PublisherBase {
diff --git a/plugins/techdocs-backend/config.d.ts b/plugins/techdocs-backend/config.d.ts
index d8049daec9..da3cd34830 100644
--- a/plugins/techdocs-backend/config.d.ts
+++ b/plugins/techdocs-backend/config.d.ts
@@ -128,7 +128,7 @@ export interface Config {
              * If not set, encrypted buckets will fail to publish.
              * https://docs.aws.amazon.com/AmazonS3/latest/userguide/specifying-s3-encryption.html
              */
-            sse: 'aws:kms' | 'AES256';
+            sse?: 'aws:kms' | 'AES256';
           };
         }
       | {