diff --git a/invenio/invenio.cfg b/invenio/invenio.cfg
index 3276817..bbbfb06 100644
--- a/invenio/invenio.cfg
+++ b/invenio/invenio.cfg
@@ -223,6 +223,10 @@ S3_ACCESS_KEY_ID = "CHANGE_ME"
 S3_SECRET_ACCESS_KEY = "CHANGE_ME"
 S3_REGION_NAME = "eu-west-1"
 S3_DIRECT_UPLOAD = True
+S3_ARGS = {
+    "ACL": "private",
+    "ServerSideEncryption": "AES256",
+}
 S3_MULTIPART_UPLOAD_THRESHOLD = 100 * 1024**2  # 100 MB
 S3_MULTIPART_UPLOAD_PART_SIZE = 525 * 1024**2  # 525 MB
 S3_MULTIPART_MAX_PARTS = 10000  # S3 limit