diff --git a/README.md b/README.md
index e0ba7fdf..5533a88a 100644
--- a/README.md
+++ b/README.md
@@ -392,7 +392,7 @@ module "cdn" {
 | Name | Version |
 | ---- | ------- |
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.13.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.40.0 |
 | <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.2 |
 | <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.7 |
 
@@ -400,7 +400,7 @@ module "cdn" {
 
 | Name | Version |
 | ---- | ------- |
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.13.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.40.0 |
 | <a name="provider_random"></a> [random](#provider\_random) | >= 2.2 |
 | <a name="provider_time"></a> [time](#provider\_time) | >= 0.7 |
 
@@ -457,6 +457,7 @@ module "cdn" {
 | <a name="input_allowed_methods"></a> [allowed\_methods](#input\_allowed\_methods) | List of allowed methods (e.g. GET, PUT, POST, DELETE, HEAD) for AWS CloudFront | `list(string)` | <pre>[<br/>  "DELETE",<br/>  "GET",<br/>  "HEAD",<br/>  "OPTIONS",<br/>  "PATCH",<br/>  "POST",<br/>  "PUT"<br/>]</pre> | no |
 | <a name="input_attributes"></a> [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,<br/>in the order they appear in the list. New attributes are appended to the<br/>end of the list. The elements of the list are joined by the `delimiter`<br/>and treated as a single ID element. | `list(string)` | `[]` | no |
 | <a name="input_block_origin_public_access_enabled"></a> [block\_origin\_public\_access\_enabled](#input\_block\_origin\_public\_access\_enabled) | When set to 'true' the s3 origin bucket will have public access block enabled | `bool` | `false` | no |
+| <a name="input_blocked_encryption_types"></a> [blocked\_encryption\_types](#input\_blocked\_encryption\_types) | List of server-side encryption types to block on the origin S3 bucket, e.g. `["SSE-C"]`.<br/>Leave as `null` to keep whatever S3 already has in effect, including the AWS default<br/>that disables SSE-C for buckets created from March 2026 onward. | `list(string)` | `null` | no |
 | <a name="input_bucket_versioning"></a> [bucket\_versioning](#input\_bucket\_versioning) | State of bucket versioning option | `string` | `"Disabled"` | no |
 | <a name="input_cache_policy_id"></a> [cache\_policy\_id](#input\_cache\_policy\_id) | The unique identifier of the existing cache policy to attach to the default cache behavior.<br/>If not provided, this module will add a default cache policy using other provided inputs. | `string` | `null` | no |
 | <a name="input_cached_methods"></a> [cached\_methods](#input\_cached\_methods) | List of cached methods (e.g. GET, PUT, POST, DELETE, HEAD) | `list(string)` | <pre>[<br/>  "GET",<br/>  "HEAD"<br/>]</pre> | no |
diff --git a/main.tf b/main.tf
index 67d2184a..1feeb1ac 100644
--- a/main.tf
+++ b/main.tf
@@ -340,13 +340,18 @@ resource "aws_s3_bucket_versioning" "origin" {
 }
 
 resource "aws_s3_bucket_server_side_encryption_configuration" "origin" {
-  count = var.encryption_enabled && local.create_s3_origin_bucket ? 1 : 0
+  count = local.create_s3_origin_bucket && (var.encryption_enabled || var.blocked_encryption_types != null) ? 1 : 0
 
   bucket = one(aws_s3_bucket.origin).id
 
   rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
+    blocked_encryption_types = var.blocked_encryption_types
+
+    dynamic "apply_server_side_encryption_by_default" {
+      for_each = var.encryption_enabled ? [1] : []
+      content {
+        sse_algorithm = "AES256"
+      }
     }
   }
 }
diff --git a/variables.tf b/variables.tf
index 8ce31ec1..7c6e6ff5 100644
--- a/variables.tf
+++ b/variables.tf
@@ -377,6 +377,16 @@ variable "encryption_enabled" {
   description = "When set to 'true' the resource will have aes256 encryption enabled by default"
 }
 
+variable "blocked_encryption_types" {
+  type        = list(string)
+  default     = null
+  description = <<-EOT
+    List of server-side encryption types to block on the origin S3 bucket, e.g. `["SSE-C"]`.
+    Leave as `null` to keep whatever S3 already has in effect, including the AWS default
+    that disables SSE-C for buckets created from March 2026 onward.
+    EOT
+}
+
 variable "index_document" {
   type        = string
   default     = "index.html"
diff --git a/versions.tf b/versions.tf
index 6890633b..68937380 100644
--- a/versions.tf
+++ b/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 6.13.0"
+      version = ">= 6.40.0"
     }
     random = {
       source  = "hashicorp/random"