diff --git a/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc b/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc
index fc26f92bfb..70bde35f79 100644
--- a/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc
+++ b/modules/learn/pages/clusters-and-availability/xdcr-overview.adoc
@@ -250,6 +250,10 @@ Before attempting to enable half-secure replications, see the important informat
 
 For step-by-step procedures, see xref:manage:manage-xdcr/secure-xdcr-replication.adoc[Secure a Replication].
 
+In addition to the connection security described above, Couchbase Server's native encryption at rest also protects XDCR's persisted data.
+When the administrator enables Configuration Encryption, Couchbase Server automatically encrypts XDCR metadata — including remote-cluster references, replication specifications, checkpoints, and collection mappings.
+When the administrator enables Logs Encryption, Couchbase Server also encrypts the XDCR log file (goxdcr.log). XDCR requires no separate configuration. For more information, see xref:security/native-encryption-at-rest-overview.adoc#encrypting-audit-logs-and-configuration-data[Native Encryption at Rest].
+
 [#xdcr-advanced-settings]
 == XDCR Advanced Settings
 
diff --git a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc
index c35357e780..80fa217301 100644
--- a/modules/learn/pages/security/native-encryption-at-rest-overview.adoc
+++ b/modules/learn/pages/security/native-encryption-at-rest-overview.adoc
@@ -94,6 +94,9 @@ This includes:
 
 * Logs of some services are not encrypted by NS Server.
 For example, Analytics log files such as `analytics_debug.log` and `analytics_periodic_dump.log` remain unencrypted even when encryption-at-rest for logs is enabled.
+
+* Couchbase Server stores most XDCR metadata — remote cluster references and replication specifications — using the same mechanism as other configuration data. When you enable encryption for configuration data, Couchbase Server also encrypts this XDCR metadata.
+XDCR checkpoints, collection manifests, and broken maps are stored in a separate internal storage mechanism and they are encrypted as well.
 ====
 
 [#when-data-is-encrypted]