diff --git a/qa/suites/rgw/crypt/2-kms/vault_transit.yaml b/qa/suites/rgw/crypt/2-kms/vault_transit.yaml
index 4e6d2702515..d20bb52bcbf 100644
--- a/qa/suites/rgw/crypt/2-kms/vault_transit.yaml
+++ b/qa/suites/rgw/crypt/2-kms/vault_transit.yaml
@@ -13,6 +13,8 @@ overrides:
   rgw:
     client.0:
       use-vault-role: client.0
+  s3tests:
+    with-sse-s3: true
 
 tasks:
 - vault:
diff --git a/qa/tasks/s3tests.py b/qa/tasks/s3tests.py
index 2465f97d01c..3749d9289f0 100644
--- a/qa/tasks/s3tests.py
+++ b/qa/tasks/s3tests.py
@@ -424,6 +424,8 @@ def run_tests(ctx, config):
         attrs = ["!fails_on_rgw", "!lifecycle_expiration", "!fails_strict_rfc2616","!test_of_sts","!webidentity_test"]
         if client_config.get('calling-format') != 'ordinary':
             attrs += ['!fails_with_subdomain']
+        if not client_config.get('with-sse-s3'):
+            attrs += ['!sse-s3']
        
         if 'extra_attrs' in client_config:
             attrs = client_config.get('extra_attrs')