diff --git a/app.config.js b/app.config.js
index 562fda1a..08714d55 100644
--- a/app.config.js
+++ b/app.config.js
@@ -58,10 +58,10 @@ module.exports = {
       bundleIdentifier: 'org.bulwarkmail.mobile',
       buildNumber: IOS_BUILD_NUMBER,
       config: {
-        // The app only speaks HTTPS/TLS and uses platform crypto, which is
-        // exempt. Declaring it here skips the manual export-compliance
-        // questionnaire that otherwise blocks every TestFlight build.
-        usesNonExemptEncryption: false,
+        // PGP and S/MIME (#58) add end-to-end encryption beyond HTTPS/TLS,
+        // so the app declares non-exempt encryption; App Store Connect asks
+        // for the export compliance documentation on upload.
+        usesNonExemptEncryption: true,
       },
     },
     android: {
diff --git a/src/lib/__tests__/export-compliance.test.ts b/src/lib/__tests__/export-compliance.test.ts
new file mode 100644
index 00000000..d50a0134
--- /dev/null
+++ b/src/lib/__tests__/export-compliance.test.ts
@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+
+// With PGP and S/MIME in the app (#58) the encryption is no longer only
+// HTTPS/TLS, so the App Store export compliance answer must say so.
+
+describe('export compliance', () => {
+  it('declares non-exempt encryption for iOS', () => {
+    const src = fs.readFileSync(path.resolve(__dirname, '../../../app.config.js'), 'utf8');
+    expect(src).toMatch(/usesNonExemptEncryption: true/);
+    expect(src).not.toMatch(/usesNonExemptEncryption: false/);
+  });
+});