diff --git a/src/amd/common/ac_vcn_dec.h b/src/amd/common/ac_vcn_dec.h
index c0283a25cd6..591c3a8a71c 100644
--- a/src/amd/common/ac_vcn_dec.h
+++ b/src/amd/common/ac_vcn_dec.h
@@ -350,6 +350,7 @@
 #define DRM_CMD_DRM_BYPASS_MASK        (0x80000000)
 
 /* Drm_cntl definitions */
+#define DRM_CNTL_CENC_ENABLE_SHIFT     (0)
 #define DRM_CNTL_ENC_BYTECNT_SHIFT     (6)
 #define DRM_CNTL_CLR_BYTECNT_SHIFT     (16)
 #define DRM_CNTL_BYPASS_SHIFT          (24)
diff --git a/src/gallium/drivers/radeonsi/radeon_vcn_dec.c b/src/gallium/drivers/radeonsi/radeon_vcn_dec.c
index 5883d2f1cb5..0a30d7bcb0a 100644
--- a/src/gallium/drivers/radeonsi/radeon_vcn_dec.c
+++ b/src/gallium/drivers/radeonsi/radeon_vcn_dec.c
@@ -655,6 +655,31 @@ static void get_h265_reflist(rvcn_dec_message_hevc_direct_ref_list_t *hevc_refli
    }
 }
 
+static void set_drm_keys_cenc(rvcn_dec_message_drm_t *drm, amd_secure_buffer_format *secure_buf)
+{
+   drm->drm_offset = 0;
+   drm->drm_cmd = 0;
+   drm->drm_cntl = 0;
+   drm->drm_max_res = 0;
+
+   memcpy(drm->drm_wrapped_key, secure_buf->key_blob.wrapped_key, 16);
+   memcpy(drm->drm_key, secure_buf->key_blob.wrapped_key_iv, 16);
+   memcpy(drm->drm_counter, secure_buf->desc.iv, 16);
+
+   drm->drm_subsample_size = secure_buf->desc.subsamples_length;
+
+   drm->drm_cmd |= 1 << DRM_CMD_KEY_SHIFT;
+   drm->drm_cmd |= 1 << DRM_CMD_CNT_KEY_SHIFT;
+   drm->drm_cmd |= 1 << DRM_CMD_CNT_DATA_SHIFT;
+   drm->drm_cmd |= 1 << DRM_CMD_OFFSET_SHIFT;
+   drm->drm_cmd |= 1 << DRM_CMD_GEN_MASK_SHIFT;
+   drm->drm_cmd |= 0xFF << DRM_CMD_BYTE_MASK_SHIFT;
+   drm->drm_cmd |= secure_buf->key_blob.u.s.drm_session_id << DRM_CMD_SESSION_SEL_SHIFT;
+   drm->drm_cmd |= 1 << DRM_CMD_UNWRAP_KEY_SHIFT;
+
+   drm->drm_cntl |= 0x3 << DRM_CNTL_CENC_ENABLE_SHIFT;
+}
+
 static void set_drm_keys(rvcn_dec_message_drm_t *drm, DECRYPT_PARAMETERS *decrypted)
 {
    int cbc = decrypted->u.s.cbc;
@@ -1815,7 +1840,10 @@ static struct pb_buffer_lean *rvcn_dec_message_decode(struct radeon_decoder *dec
 
    if (encrypted) {
       assert(sscreen->info.has_tmz_support);
-      set_drm_keys(drm, decrypt);
+      if (picture->cenc)
+         set_drm_keys_cenc(drm, secure_buf);
+      else
+         set_drm_keys(drm, decrypt);
    }
 
    if (dec->dpb_type == DPB_DYNAMIC_TIER_1) {