diff --git a/pkg/operator/ceph/cluster/cluster.go b/pkg/operator/ceph/cluster/cluster.go
index 5b9fb08d5..3545eb501 100755
--- a/pkg/operator/ceph/cluster/cluster.go
+++ b/pkg/operator/ceph/cluster/cluster.go
@@ -604,14 +604,18 @@ func (c *cluster) configureMsgr2() error {
 	monStore := config.GetMonStore(c.context, c.ClusterInfo)
 	if c.Spec.Network.Connections.Encryption != nil {
 		encryptionSetting := "crc secure"
+		// crc mode, if denied agree to secure mode
+		defaultRBDMapOptions := "ms_mode=prefer-crc"
 		if c.Spec.Network.Connections.Encryption.Enabled {
 			encryptionSetting = "secure"
+			defaultRBDMapOptions = "ms_mode=secure"
 		}
 
 		globalConfigSettings := map[string]string{
-			"ms_cluster_mode": encryptionSetting,
-			"ms_service_mode": encryptionSetting,
-			"ms_client_mode":  encryptionSetting,
+			"ms_cluster_mode":         encryptionSetting,
+			"ms_service_mode":         encryptionSetting,
+			"ms_client_mode":          encryptionSetting,
+			"rbd_default_map_options": defaultRBDMapOptions,
 		}
 
 		logger.Infof("setting msgr2 encryption mode to %q", encryptionSetting)
diff --git a/tests/framework/installer/ceph_manifests.go b/tests/framework/installer/ceph_manifests.go
index 0b5bcb3af..0b8ec0965 100644
--- a/tests/framework/installer/ceph_manifests.go
+++ b/tests/framework/installer/ceph_manifests.go
@@ -314,11 +314,6 @@ parameters:
   imageFeatures: layering
   csi.storage.k8s.io/fstype: ext4
 `
-	if m.settings.ConnectionsEncrypted {
-		// encryption requires either the 5.11 kernel or the nbd mounter. Until the newer
-		// kernel is available in minikube, we need to test with nbd.
-		sc += "  mounter: rbd-nbd"
-	}
 	return sc
 }