diff --git a/values/cilium/env-ekman.yaml.gotmpl b/values/cilium/env-ekman.yaml.gotmpl
index 2d395026..065e3a32 100644
--- a/values/cilium/env-ekman.yaml.gotmpl
+++ b/values/cilium/env-ekman.yaml.gotmpl
@@ -1,5 +1,10 @@
 cilium:
   enabled: true
+  # WireGuard cannot be used during migration -- Flannel nodes have no WireGuard
+  # keys so encrypted traffic is unreadable by them.
+  # TODO: re-enable after migration
+  encryption:
+    enabled: false
   envoy:
     enabled: true
   # kube-proxy stays running during migration; disable replacement until done.