diff --git a/.changeset/eff-212-secure-mssql-transport.md b/.changeset/eff-212-secure-mssql-transport.md
new file mode 100644
index 00000000000..f662266f921
--- /dev/null
+++ b/.changeset/eff-212-secure-mssql-transport.md
@@ -0,0 +1,7 @@
+---
+"@effect/sql-mssql": patch
+---
+
+**Breaking:** Secure Microsoft SQL Server connections by default by enabling encryption and validating server certificates.
+
+Users connecting to SQL Server instances without TLS must now explicitly set `encrypt: false`. Users connecting with untrusted or self-signed certificates must explicitly set `trustServer: true`.
diff --git a/packages/sql/mssql/src/MssqlClient.ts b/packages/sql/mssql/src/MssqlClient.ts
index 7f47882425c..ed22924d743 100644
--- a/packages/sql/mssql/src/MssqlClient.ts
+++ b/packages/sql/mssql/src/MssqlClient.ts
@@ -206,7 +206,13 @@ export interface MssqlClientConfig {
   readonly domain?: string | undefined
   readonly server: string
   readonly instanceName?: string | undefined
+  /**
+   * Whether to encrypt traffic between the client and server. Defaults to `true`. Setting this to `false` disables transport encryption and transmits credentials in cleartext.
+   */
   readonly encrypt?: boolean | undefined
+  /**
+   * Whether to trust the server certificate without validating it. Defaults to `false`. Setting this to `true` disables TLS certificate validation.
+   */
   readonly trustServer?: boolean | undefined
   readonly port?: number | undefined
   readonly authType?: string | undefined
@@ -284,7 +290,7 @@ export const make = (
         options: {
           port: options.port,
           database: options.database,
-          trustServerCertificate: options.trustServer ?? true,
+          trustServerCertificate: options.trustServer ?? false,
           multiSubnetFailover: options.multiSubnetFailover,
           connectTimeout: options.connectTimeout
             ? Duration.toMillis(Duration.fromInputUnsafe(options.connectTimeout))
@@ -292,7 +298,7 @@ export const make = (
           rowCollectionOnRequestCompletion: true,
           useColumnNames: false,
           instanceName: options.instanceName,
-          encrypt: options.encrypt ?? false,
+          encrypt: options.encrypt ?? true,
           cancelTimeout: options.cancelTimeout
             ? Duration.toMillis(Duration.fromInputUnsafe(options.cancelTimeout))
             : undefined,