diff --git a/S3-Table-Bucket-Commands.md b/S3-Table-Bucket-Commands.md
index b91797f..602e6aa 100644
--- a/S3-Table-Bucket-Commands.md
+++ b/S3-Table-Bucket-Commands.md
@@ -56,6 +56,12 @@ curl -X POST $S3_ENDPOINT/ \
 > Buckets created before this field existed carry no declaration and keep
 > accepting either format. See [[SeaweedFS Lance Catalog]].
 
+> [!NOTE]
+> `encryptionConfiguration` may be sent on create and is echoed back by
+> `GetTableBucket`. Only `{"sseAlgorithm": "AES256"}` is admitted; an `sseType`
+> field or a `kmsKeyArn` is refused. The declaration is stored as bucket
+> metadata — the storage path does not encrypt with it.
+
 ---
 
 ### List Table Buckets