diff --git a/aws.post_update.php b/aws.post_update.php
new file mode 100644
index 0000000000000000000000000000000000000000..e6383303b0bfd4627dbc69bb999fc1c77ce8c655
--- /dev/null
+++ b/aws.post_update.php
@@ -0,0 +1,19 @@
+<?php
+
+/**
+ * Ensure all AWS profiles have a default encryption profile set.
+ */
+function aws_post_update_encryption_profile_default() {
+  /** @var \Drupal\aws\Entity\ProfileInterface[] $profiles */
+  $profiles = \Drupal::entityTypeManager()
+    ->getStorage('aws_profile')
+    ->loadMultiple();
+
+  foreach ($profiles as $profile) {
+    if (!$profile->getEncryptionProfile()) {
+      $profile
+        ->setEncryptionProfile('_none')
+        ->save();
+    }
+  }
+}
diff --git a/src/Entity/Form/ProfileForm.php b/src/Entity/Form/ProfileForm.php
index 6a9415c8acda281f8aa17f79995791d5f6c60d55..1eacb78c18a25d7639fbe08e1453e062da0cab78 100644
--- a/src/Entity/Form/ProfileForm.php
+++ b/src/Entity/Form/ProfileForm.php
@@ -147,23 +147,24 @@ class ProfileForm extends EntityForm {
       '#default_value' => $this->entity->getRegion(),
     ];
 
-    if ($this->encryptionProfileManager) {
-      $options = ['_none' => $this->t('- None -')];
+    $encryption_options = ['_none' => $this->t('- None -')];
 
+    if ($this->encryptionProfileManager) {
       $encryption_profiles = $this->encryptionProfileManager->getAllEncryptionProfiles();
       foreach ($encryption_profiles as $id => $profile) {
-        $options[$id] = $profile->label();
+        $encryption_options[$id] = $profile->label();
       }
-
-      $form['encryption_profile'] = [
-        '#type' => 'select',
-        '#title' => $this->t('Encryption Profile'),
-        '#description' => $this->t('The encryption profile to use to encrypt the secret key.'),
-        '#options' => $options,
-        '#default_value' => $this->entity->getEncryptionProfile(),
-      ];
     }
 
+    $form['encryption_profile'] = [
+      '#type' => 'select',
+      '#title' => $this->t('Encryption Profile'),
+      '#description' => $this->t('The encryption profile to use to encrypt the secret key.'),
+      '#options' => $encryption_options,
+      '#default_value' => $this->entity->getEncryptionProfile(),
+      '#access' => $this->encryptionProfileManager,
+    ];
+
     return $form;
   }
 
diff --git a/src/Entity/Profile.php b/src/Entity/Profile.php
index c2f9329880457677decab5b87eb69fe8e7f3d86f..7e76c1b5da5fc16c85516e86b5307be17870775a 100644
--- a/src/Entity/Profile.php
+++ b/src/Entity/Profile.php
@@ -245,7 +245,7 @@ class Profile extends ConfigEntityBase implements ProfileInterface {
    * {@inheritdoc}
    */
   public function getEncryptionProfile() {
-    return $this->encryption_profile;
+    return $this->encryption_profile ?? '_none';
   }
 
   /**