diff --git a/bellows/zigbee/application.py b/bellows/zigbee/application.py
index f64254ac..bee1ca54 100644
--- a/bellows/zigbee/application.py
+++ b/bellows/zigbee/application.py
@@ -1000,6 +1000,9 @@ async def send_packet(self, packet: zigpy.types.ZigbeePacket) -> None:
         else:
             aps_frame.options |= t.EmberApsOption.APS_OPTION_ENABLE_ROUTE_DISCOVERY
 
+        if zigpy.types.TransmitOptions.APS_Encryption in packet.tx_options:
+            aps_frame.options |= t.EmberApsOption.APS_OPTION_ENCRYPTION
+
         extended_timeout = packet.extended_timeout
 
         # EmberZNet requires retrying to enable APS ACKs
diff --git a/tests/test_application.py b/tests/test_application.py
index 9170747b..c5355d2e 100644
--- a/tests/test_application.py
+++ b/tests/test_application.py
@@ -990,6 +990,23 @@ async def test_send_packet_unicast_force_route_discovery(app, packet):
     )
 
 
+async def test_send_packet_unicast_aps_encryption(app, packet):
+    await _test_send_packet_unicast(
+        app,
+        packet.replace(
+            tx_options=(
+                zigpy.types.TransmitOptions.ACK
+                | zigpy.types.TransmitOptions.APS_Encryption
+            )
+        ),
+        options=(
+            t.EmberApsOption.APS_OPTION_ENABLE_ROUTE_DISCOVERY
+            | t.EmberApsOption.APS_OPTION_ENCRYPTION
+            | t.EmberApsOption.APS_OPTION_RETRY
+        ),
+    )
+
+
 async def test_send_packet_unicast_unexpected_failure(app, packet):
     with pytest.raises(zigpy.exceptions.DeliveryError):
         await _test_send_packet_unicast(app, packet, status=t.EmberStatus.ERR_FATAL)