diff --git a/pkg/settings/cresettings/README.md b/pkg/settings/cresettings/README.md
index caa8b70f78..1bc17597e9 100644
--- a/pkg/settings/cresettings/README.md
+++ b/pkg/settings/cresettings/README.md
@@ -42,6 +42,7 @@ flowchart
         VaultBase64EncodingEnabled[/VaultBase64EncodingEnabled\]:::gate
         VaultForceEmptyOCRRounds[/VaultForceEmptyOCRRounds\]:::gate
         VaultOptimizationsEnabled[/VaultOptimizationsEnabled\]:::gate
+        VaultCiphertextlessObservationsEnabled[/VaultCiphertextlessObservationsEnabled\]:::gate
     end
 
     subgraph HandleNodeMessage[gatewayHandler.HandleNodeMessage]
diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json
index 6b18c23803..88a3665df1 100644
--- a/pkg/settings/cresettings/defaults.json
+++ b/pkg/settings/cresettings/defaults.json
@@ -9,6 +9,7 @@
 	"VaultBase64EncodingEnabled": "false",
 	"VaultForceEmptyOCRRounds": "false",
 	"VaultOptimizationsEnabled": "false",
+	"VaultCiphertextlessObservationsEnabled": "false",
 	"GatewayHTTPGlobalRate": "500rps:500",
 	"GatewayHTTPPerNodeRate": "100rps:100",
 	"GatewayConfidentialRelayGlobalRate": "50rps:10",
diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml
index 39d275d096..d34138f71d 100644
--- a/pkg/settings/cresettings/defaults.toml
+++ b/pkg/settings/cresettings/defaults.toml
@@ -8,6 +8,7 @@ PropagateOrgIDInRequestMetadata = 'false'
 VaultBase64EncodingEnabled = 'false'
 VaultForceEmptyOCRRounds = 'false'
 VaultOptimizationsEnabled = 'false'
+VaultCiphertextlessObservationsEnabled = 'false'
 GatewayHTTPGlobalRate = '500rps:500'
 GatewayHTTPPerNodeRate = '100rps:100'
 GatewayConfidentialRelayGlobalRate = '50rps:10'
diff --git a/pkg/settings/cresettings/settings.go b/pkg/settings/cresettings/settings.go
index e164696407..2e5ce0937b 100644
--- a/pkg/settings/cresettings/settings.go
+++ b/pkg/settings/cresettings/settings.go
@@ -63,6 +63,7 @@ var Default = Schema{
 	VaultBase64EncodingEnabled:             Bool(false),
 	VaultForceEmptyOCRRounds:               Bool(false),
 	VaultOptimizationsEnabled:              Bool(false),
+	VaultCiphertextlessObservationsEnabled: Bool(false),
 	GatewayHTTPGlobalRate:                  Rate(rate.Limit(500), 500),
 	GatewayHTTPPerNodeRate:                 Rate(rate.Limit(100), 100),
 	GatewayConfidentialRelayGlobalRate:     Rate(rate.Limit(50), 10),
@@ -263,6 +264,7 @@ type Schema struct {
 	VaultBase64EncodingEnabled             Setting[bool]
 	VaultForceEmptyOCRRounds               Setting[bool]
 	VaultOptimizationsEnabled              Setting[bool]
+	VaultCiphertextlessObservationsEnabled Setting[bool]
 	GatewayHTTPGlobalRate                  Setting[config.Rate]
 	GatewayHTTPPerNodeRate                 Setting[config.Rate]
 	GatewayConfidentialRelayGlobalRate     Setting[config.Rate]
diff --git a/pkg/settings/cresettings/settings_test.go b/pkg/settings/cresettings/settings_test.go
index 8e3569bdcd..b9334dae17 100644
--- a/pkg/settings/cresettings/settings_test.go
+++ b/pkg/settings/cresettings/settings_test.go
@@ -130,6 +130,7 @@ func TestSchema_Unmarshal(t *testing.T) {
 	assert.False(t, cfg.VaultBase64EncodingEnabled.DefaultValue)
 	assert.False(t, cfg.VaultForceEmptyOCRRounds.DefaultValue)
 	assert.False(t, cfg.VaultOptimizationsEnabled.DefaultValue)
+	assert.False(t, cfg.VaultCiphertextlessObservationsEnabled.DefaultValue)
 	assert.Equal(t, config.Rate{Limit: rate.Limit(20), Burst: 7}, cfg.GatewayConfidentialRelayGlobalRate.DefaultValue)
 	assert.Equal(t, config.Rate{Limit: rate.Limit(4), Burst: 2}, cfg.GatewayConfidentialRelayPerNodeRate.DefaultValue)
 	assert.Equal(t, 48*time.Hour, cfg.PerOrg.ZeroBalancePruningTimeout.DefaultValue)