diff --git a/conf/dialplan/default.xml b/conf/dialplan/default.xml
index c2b425f52f..0ec71f0cd2 100644
--- a/conf/dialplan/default.xml
+++ b/conf/dialplan/default.xml
@@ -54,6 +54,8 @@
       </condition>
       <condition field="${sip_has_crypto}" expression="^(AES_CM_128_HMAC_SHA1_32|AES_CM_128_HMAC_SHA1_80)$" break="never">
 	<action application="set" data="sip_secure_media=true"/>
+	<!-- Offer SRTP on outbound legs if we have it on inbound. -->
+	<action application="export" data="sip_secure_media=true"/>
       </condition>
       <condition>
 	<action application="db" data="insert/spymap/${caller_id_number}/${uuid}"/>
diff --git a/conf/sip_profiles/default.xml b/conf/sip_profiles/default.xml
index 2909120737..2892b44552 100644
--- a/conf/sip_profiles/default.xml
+++ b/conf/sip_profiles/default.xml
@@ -46,7 +46,7 @@
     <!--<param name="bind-params" value="transport=udp"/>-->
 
     <!-- TLS: disabled by default, set to "true" to enable -->
-    <param name="tls" value="false"/>
+    <param name="tls" value="true"/>
     <!-- additional bind parameters for TLS -->
     <param name="tls-bind-params" value="transport=tls"/>
     <!-- Port to listen on for TLS requests. (5061 will be used if unspecified) -->