diff --git a/pkg/daemon/ceph/osd/daemon.go b/pkg/daemon/ceph/osd/daemon.go
index e20a1c372..a5513d00c 100644
--- a/pkg/daemon/ceph/osd/daemon.go
+++ b/pkg/daemon/ceph/osd/daemon.go
@@ -158,7 +158,8 @@ func configRawDevice(name string, context *clusterd.Context) (*sys.LocalDisk, er
 
 // Provision provisions an OSD
 func Provision(context *clusterd.Context, agent *OsdAgent, crushLocation, topologyAffinity string) error {
-	if agent.pvcBacked {
+	if agent.pvcBacked && os.Getenv(oposd.EncryptedDeviceEnvVarName) == "true" {
+		logger.Debug("encryption configuration detecting, populating kek to an env variable")
 		// Init KMS store, retrieve the KEK and store it as an env var for ceph-volume
 		err := setKEKinEnv(context, agent.clusterInfo)
 		if err != nil {
diff --git a/pkg/daemon/ceph/osd/encryption.go b/pkg/daemon/ceph/osd/encryption.go
index 9bf2f657a..513ebd1d7 100644
--- a/pkg/daemon/ceph/osd/encryption.go
+++ b/pkg/daemon/ceph/osd/encryption.go
@@ -103,8 +103,7 @@ func setKEKinEnv(context *clusterd.Context, clusterInfo *cephclient.ClusterInfo)
 		return errors.Wrap(err, "failed to set key encryption key env variable for ceph-volume")
 	}
 
-	logger.Debug("successfully set vault env variables")
-
+	logger.Debug("successfully set kek to env variable")
 	return nil
 }
 
diff --git a/pkg/daemon/ceph/osd/kms/envs.go b/pkg/daemon/ceph/osd/kms/envs.go
index 3e7e82996..92c4ded06 100644
--- a/pkg/daemon/ceph/osd/kms/envs.go
+++ b/pkg/daemon/ceph/osd/kms/envs.go
@@ -134,6 +134,7 @@ func ConfigEnvsToMapString() map[string]string {
 		pair := strings.SplitN(e, "=", 2)
 		for _, knownKMS := range knownKMSPrefix {
 			if strings.HasPrefix(pair[0], knownKMS) || pair[0] == Provider {
+				logger.Debugf("adding env %q", pair[0])
 				envs[pair[0]] = os.Getenv(pair[0])
 			}
 		}