diff --git a/projects/kit/offline/src/lib/offline-contract.spec.ts b/projects/kit/offline/src/lib/offline-contract.spec.ts
index 1493022..d5118cf 100644
--- a/projects/kit/offline/src/lib/offline-contract.spec.ts
+++ b/projects/kit/offline/src/lib/offline-contract.spec.ts
@@ -66,10 +66,25 @@ describe('shared offline boundary contracts', () => {
       provideOffline({
         mode: 'readCacheOnly',
         databaseName: 'read-cache',
+        createEncryptionKey: async () => 'native-cache-key',
         replicaSchema: defineOfflineReplicaSchema({ version: 1, entities: [], migrations: [] }),
         requestPolicies: [],
       });
     };
     void compileOnly;
   });
+
+  it('requires an encryption key factory for synchronized providers at compile time', () => {
+    type Options = import('./offline-provider').ProvideSynchronizedOfflineOptions;
+    type IsRequired = Record<string, never> extends Pick<Options, 'createEncryptionKey'> ? false : true;
+    const createEncryptionKeyIsRequired: IsRequired = true;
+    expect(createEncryptionKeyIsRequired).toBe(true);
+  });
+
+  it('requires an encryption key factory for native read-cache persistence too', () => {
+    type Options = import('./offline-provider').ProvideReadCacheOfflineOptions;
+    type IsRequired = Record<string, never> extends Pick<Options, 'createEncryptionKey'> ? false : true;
+    const createEncryptionKeyIsRequired: IsRequired = true;
+    expect(createEncryptionKeyIsRequired).toBe(true);
+  });
 });
diff --git a/projects/kit/offline/src/lib/offline-provider.ts b/projects/kit/offline/src/lib/offline-provider.ts
index 206e52f..431d865 100644
--- a/projects/kit/offline/src/lib/offline-provider.ts
+++ b/projects/kit/offline/src/lib/offline-provider.ts
@@ -36,6 +36,8 @@ interface ProvideOfflineOptionsBase extends OfflineKitOptions {
 /** Full replica pull and durable Outbox synchronization. */
 export interface ProvideSynchronizedOfflineOptions extends ProvideOfflineOptionsBase {
   mode?: 'synchronized';
+  /** Creates the encrypted native database key on first install. */
+  createEncryptionKey: () => Promise<string>;
   /** Product policies that replace matched writes with atomic local-first mutations. */
   mutationPolicies?: readonly Type<OfflineMutationRequestPolicy>[];
   /** Product adapter that sends opaque commands to its API. */
@@ -47,6 +49,8 @@ export interface ProvideSynchronizedOfflineOptions extends ProvideOfflineOptions
 /** Server- or external-source read cache with no mutation transport or Outbox. */
 export interface ProvideReadCacheOfflineOptions extends ProvideOfflineOptionsBase {
   mode: 'readCacheOnly';
+  /** Creates the encrypted native cache database key on first install. Unused by the web repository. */
+  createEncryptionKey: () => Promise<string>;
   mutationPolicies?: never;
   commandExecutor?: never;
   replicaPuller?: never;