diff --git a/roots.cpp b/roots.cpp
index c0348d7..3cc7b41 100644
--- a/roots.cpp
+++ b/roots.cpp
@@ -321,7 +321,9 @@
   }
 
   // Has to be f2fs because we checked earlier.
-  std::vector<std::string> f2fs_args = { "/sbin/mkfs.f2fs", "-t", "-d1", v->blk_device };
+  std::vector<std::string> f2fs_args = { "/sbin/mkfs.f2fs", "-d1", "-f",
+                                         "-O", "encrypt", "-O", "quota",
+                                         v->blk_device };
   if (length >= 512) {
     f2fs_args.push_back(std::to_string(length / 512));
   }
diff --git a/updater/install.cpp b/updater/install.cpp
index b865081..a111f4b 100644
--- a/updater/install.cpp
+++ b/updater/install.cpp
@@ -303,10 +303,16 @@
     std::string num_sectors = std::to_string(size / 512);
 
     const char* f2fs_path = "/sbin/mkfs.f2fs";
-    const char* f2fs_argv[] = {
-      "mkfs.f2fs", "-t", "-d1", location.c_str(), (size < 512) ? nullptr : num_sectors.c_str(),
-      nullptr
-    };
+    const char* f2fs_argv[] = { "mkfs.f2fs",
+                                "-d1",
+                                "-f",
+                                "-O",
+                                "encrypt",
+                                "-O",
+                                "quota",
+                                location.c_str(),
+                                (size < 512) ? nullptr : num_sectors.c_str(),
+                                nullptr };
     int status = exec_cmd(f2fs_path, const_cast<char**>(f2fs_argv));
     if (status != 0) {
       LOG(ERROR) << name << ": mkfs.f2fs failed (" << status << ") on " << location;