diff --git a/metropolis/node/core/cluster/cluster_bootstrap.go b/metropolis/node/core/cluster/cluster_bootstrap.go
index fcc5756..690af00 100644
--- a/metropolis/node/core/cluster/cluster_bootstrap.go
+++ b/metropolis/node/core/cluster/cluster_bootstrap.go
@@ -123,7 +123,8 @@
 		JoinKey:       jpriv,
 		// No ClusterCA yet, that's added by the roleserver after it finishes curator
 		// bootstrap.
-		ClusterCa: nil,
+		ClusterCa:       nil,
+		StorageSecurity: storageSecurity,
 	}
 	if err = m.storageRoot.ESP.Metropolis.SealedConfiguration.SealSecureBoot(&sc, tpmUsage); err != nil {
 		return fmt.Errorf("writing sealed configuration failed: %w", err)