diff --git a/.env.example b/.env.example
index 8992157..f012bd1 100644
--- a/.env.example
+++ b/.env.example
@@ -5,5 +5,9 @@ MATRIX_HOME_SERVER=https://matrix.org
 MATRIX_ACCESS_TOKEN=your_real_access_token_here
 BOT_COMMAND=!quote
 
+# Stable device ID for the bot's E2EE identity. Keep this consistent
+# across restarts so the bot reuses its encryption keys.
+MATRIX_DEVICE_ID=ANCESTORBOT
+
 # If you want debug logging, set DEBUG=true
 DEBUG=false
diff --git a/index.js b/index.js
index 72cea6e..c953951 100644
--- a/index.js
+++ b/index.js
@@ -6,9 +6,12 @@ dotenv.config();
 
 console.log('🚀 Starting Ancestor Quote Bot...\n');
 
+const deviceId = process.env.MATRIX_DEVICE_ID || 'ANCESTORBOT';
+
 const client = new MatrixClient({
     accessToken: process.env.MATRIX_ACCESS_TOKEN,
     baseUrl: process.env.MATRIX_HOME_SERVER,
+    deviceId,
 });
 
 function loadQuotes() {
@@ -54,7 +57,14 @@ function loadQuotes() {
         }
 
         client.credentials.userId = userId;
-        console.log(`👤 Bot Identity: ${userId}`);
+        console.log(`👤 Bot Identity: ${userId} (device ${deviceId})`);
+
+        // Enable end-to-end encryption so the bot can read and reply in
+        // encrypted rooms. The Rust/Olm WASM backend needs no native
+        // compile. useIndexedDB=false keeps everything in memory (no
+        // IndexedDB in Node).
+        await client.initRustCrypto({ useIndexedDB: false });
+        console.log('🔐 E2EE crypto initialised (Rust/Olm WASM)');
 
         await client.startClient();
         console.log('✅ MatrixClient connected and authenticated\n');
@@ -83,11 +93,12 @@ function loadQuotes() {
         client.on('event', (event) => {
             const type = event.getType();
 
-            // Encrypted rooms: the bot has no E2EE support, so command text
-            // never arrives as plaintext and cannot be read or answered.
+            // If an event still arrives encrypted, decryption failed — the
+            // room is likely set to only share keys with verified sessions.
             if (type === 'm.room.encrypted') {
-                console.log(`🔒 [${event.getRoomId()}] encrypted message received. ` +
-                    `The bot cannot read E2EE rooms; invite it to an unencrypted room instead.`);
+                console.log(`🔒 [${event.getRoomId()}] could not decrypt message. ` +
+                    `The room may be set to share keys only with verified sessions; ` +
+                    `change room encryption settings to include this bot's device, or verify it.`);
                 return;
             }