diff --git a/CHANGELOG.md b/CHANGELOG.md
index d3a631ef..845a1cf6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -60,6 +60,8 @@ All notable changes to this project will be documented in this file.
 - The warning that `dfsReplication` is greater than the number of datanodes is now raised for
   datanodes. It was previously raised for journalnodes, even though its text refers to datanode
   replicas, and never for datanodes ([#830]).
+- Set `dfs.encrypt.data.transfer.cipher.suites` instead of the misspelt `dfs.encrypt.data.transfer.cipher.suite`.
+  Hadoop ignored the misspelt key, so block data was never encrypted with AES/CTR and was only protected by SASL DIGEST-MD5 ([#854]).
 
 ### Removed
 
@@ -86,6 +88,7 @@ All notable changes to this project will be documented in this file.
 [#847]: https://github.com/stackabletech/hdfs-operator/pull/847
 [#848]: https://github.com/stackabletech/hdfs-operator/pull/848
 [#850]: https://github.com/stackabletech/hdfs-operator/pull/850
+[#854]: https://github.com/stackabletech/hdfs-operator/pull/854
 
 ## [26.7.0] - 2026-07-21
 
diff --git a/docs/modules/hdfs/pages/usage-guide/security.adoc b/docs/modules/hdfs/pages/usage-guide/security.adoc
index e9c3aa56..3b86e5e7 100644
--- a/docs/modules/hdfs/pages/usage-guide/security.adoc
+++ b/docs/modules/hdfs/pages/usage-guide/security.adoc
@@ -33,7 +33,9 @@ The `kerberos.secretClass` is used to give HDFS the possibility to request keyta
 
 The `tlsSecretClass` is needed to request TLS certificates, used e.g. for the Web UIs.
 
-NOTE: The hdfs-operator defaults to `AES/CTR/NoPadding` for `dfs.encrypt.data.transfer.cipher.suite`. This can be changed using config overrides.
+NOTE: The hdfs-operator sets `dfs.encrypt.data.transfer.cipher.suites` to `AES/CTR/NoPadding`, in the HDFS Pods and in the discovery ConfigMap.
+Block data is only encrypted with AES if both the client and the DataNode set it, so a client that does not use the discovery ConfigMap has to set it itself.
+This can be changed using config overrides.
 
 === 4. Verify that Kerberos authentication is required
 Use `stackablectl stacklet list` to get the endpoints where the HDFS namenodes are reachable.
diff --git a/rust/operator-binary/src/controller/build/kerberos.rs b/rust/operator-binary/src/controller/build/kerberos.rs
index df0de2a3..6719d3d5 100644
--- a/rust/operator-binary/src/controller/build/kerberos.rs
+++ b/rust/operator-binary/src/controller/build/kerberos.rs
@@ -55,7 +55,7 @@ impl HdfsSiteConfigBuilder {
         self.add("dfs.data.transfer.protection", WIRE_ENCRYPTION_PRIVACY);
         self.add("dfs.encrypt.data.transfer", "true");
         self.add(
-            "dfs.encrypt.data.transfer.cipher.suite",
+            "dfs.encrypt.data.transfer.cipher.suites",
             "AES/CTR/NoPadding",
         );
         self