diff --git a/pages/iam/reference-content/permission-sets.mdx b/pages/iam/reference-content/permission-sets.mdx
index e82993c868..61b3b4c96f 100644
--- a/pages/iam/reference-content/permission-sets.mdx
+++ b/pages/iam/reference-content/permission-sets.mdx
@@ -416,6 +416,10 @@ Below is a list of the permission sets available at Scaleway.
 | KeyManagerKeyCreate    | Create permission to key manager       |
 | KeyManagerKeyRestore      | Restore permission to key manager           |
 
+<Message type="note">
+  `KeyManagerKeyEncrypt` and `KeyManagerKeyDecrypt` are also required for principals that never call Key Manager directly: uploading to and downloading from an Object Storage bucket encrypted with [SSE-KMS](/object-storage/how-to/enable-sse-kms/) requires these permissions in addition to the relevant Object Storage permission sets.
+</Message>
+
 ### Labs
 
 #### Quantum
diff --git a/pages/object-storage/api-cli/enable-sse-kms.mdx b/pages/object-storage/api-cli/enable-sse-kms.mdx
index 61c7a49125..89af063bdc 100644
--- a/pages/object-storage/api-cli/enable-sse-kms.mdx
+++ b/pages/object-storage/api-cli/enable-sse-kms.mdx
@@ -25,6 +25,11 @@ In cases when you have some objects that are stored without SSE‑KMS, you can:
 - [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
 - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/)
 - Installed and initialized the [AWS CLI](/object-storage/api-cli/object-storage-aws-cli/)
+- [Key Manager permission sets](/iam/reference-content/permission-sets/#key-manager) for every [principal](/iam/concepts/#principal) that reads or writes objects in the bucket: `KeyManagerKeyEncrypt` for `PutObject`, and `KeyManagerKeyDecrypt` for `GetObject`
+
+<Message type="important">
+Object Storage permission sets alone are not sufficient to read and write objects encrypted with SSE-KMS. An [application](/iam/concepts/#application) that has `ObjectStorageFullAccess` and no Key Manager permission set receives an "access denied" error when it calls `PutObject` on a bucket that has default encryption enabled, even when the KEK and the bucket are in the same Project.
+</Message>
 
 ## Enabling SSE-KMS for an object upload
 
diff --git a/pages/object-storage/how-to/enable-sse-kms.mdx b/pages/object-storage/how-to/enable-sse-kms.mdx
index dab902e07f..538d12337b 100644
--- a/pages/object-storage/how-to/enable-sse-kms.mdx
+++ b/pages/object-storage/how-to/enable-sse-kms.mdx
@@ -18,7 +18,11 @@ This page explains how to use SSE-KMS with the Scaleway Console. To use it with
 - A Scaleway account logged into the [console](https://console.scaleway.com)
 - [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
 - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) (optional)
+- [Key Manager permission sets](/iam/reference-content/permission-sets/#key-manager) for every [principal](/iam/concepts/#principal) that reads or writes objects in the bucket: `KeyManagerKeyEncrypt` to upload objects, and `KeyManagerKeyDecrypt` to download them
 
+<Message type="important">
+Object Storage permission sets alone are not sufficient to read and write objects encrypted with SSE-KMS. A principal that has `ObjectStorageFullAccess` and no Key Manager permission set receives an "access denied" error when it uploads an object to a bucket that has default encryption enabled, even when the KEK and the bucket are in the same Project.
+</Message>
 
 ## How to enable SSE-KMS during bucket creation