diff --git a/metropolis/cli/metroctl/cmd_install.go b/metropolis/cli/metroctl/cmd_install.go
index 62be34f..986eeca 100644
--- a/metropolis/cli/metroctl/cmd_install.go
+++ b/metropolis/cli/metroctl/cmd_install.go
@@ -41,6 +41,7 @@
 var bootstrap bool
 
 var bootstrapTPMMode string
+var bootstrapStorageSecurityPolicy string
 
 //go:embed metropolis/installer/kernel.efi
 var installer []byte
@@ -58,6 +59,21 @@
 		log.Fatalf("Invalid --bootstrap-tpm-mode (must be one of: required, best-effort, disabled)")
 	}
 
+	var bootstrapStorageSecurity cpb.ClusterConfiguration_StorageSecurityPolicy
+	switch strings.ToLower(bootstrapStorageSecurityPolicy) {
+	case "permissive":
+		bootstrapStorageSecurity = cpb.ClusterConfiguration_STORAGE_SECURITY_POLICY_PERMISSIVE
+	case "needs-encryption":
+		bootstrapStorageSecurity = cpb.ClusterConfiguration_STORAGE_SECURITY_POLICY_NEEDS_ENCRYPTION
+	case "needs-encryption-and-authentication":
+		bootstrapStorageSecurity = cpb.ClusterConfiguration_STORAGE_SECURITY_POLICY_NEEDS_ENCRYPTION_AND_AUTHENTICATION
+	case "needs-insecure":
+		bootstrapStorageSecurity = cpb.ClusterConfiguration_STORAGE_SECURITY_POLICY_NEEDS_INSECURE
+	default:
+
+		log.Fatalf("Invalid --bootstrap-storage-security (must be one of: permissive, needs-encryption, needs-encryption-and-authentication, needs-insecure)")
+	}
+
 	var bundleReader io.Reader
 	var bundleSize uint64
 	if bundlePath == nil || *bundlePath == "" {
@@ -101,7 +117,8 @@
 				ClusterBootstrap: &api.NodeParameters_ClusterBootstrap{
 					OwnerPublicKey: pub,
 					InitialClusterConfiguration: &cpb.ClusterConfiguration{
-						TpmMode: tpmMode,
+						StorageSecurityPolicy: bootstrapStorageSecurity,
+						TpmMode:               tpmMode,
 					},
 				},
 			},
@@ -149,5 +166,6 @@
 
 	genusbCmd.Flags().BoolVar(&bootstrap, "bootstrap", false, "Create a bootstrap installer image.")
 	genusbCmd.Flags().StringVar(&bootstrapTPMMode, "bootstrap-tpm-mode", "required", "TPM mode to set on cluster (required, best-effort, disabled)")
+	genusbCmd.Flags().StringVar(&bootstrapStorageSecurityPolicy, "bootstrap-storage-security", "needs-encryption-and-authentication", "Storage security policy to set on cluster (permissive, needs-encryption, needs-encryption-and-authentication, needs-insecure)")
 	installCmd.AddCommand(genusbCmd)
 }