diff --git a/docs/configuring-playbook-bridge-hookshot.md b/docs/configuring-playbook-bridge-hookshot.md
index f2f0a0eca..55c02f7f4 100644
--- a/docs/configuring-playbook-bridge-hookshot.md
+++ b/docs/configuring-playbook-bridge-hookshot.md
@@ -41,14 +41,7 @@ matrix_bridge_hookshot_enabled: true
 ```
 
 > [!NOTE]
-> End-to-bridge encryption also requires the homeserver to support (and have enabled) [MSC2409](https://github.com/matrix-org/matrix-spec-proposals/pull/2409) and [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202). If you are using Synapse, enable them by also adding this to your `vars.yml` file:
->
-> ```yaml
-> matrix_synapse_experimental_features_msc2409_to_device_messages_enabled: true
-> matrix_synapse_experimental_features_msc3202_transaction_extensions_enabled: true
-> ```
->
-> These are experimental homeserver-wide features (as is Hookshot's encryption support itself), so enable them deliberately.
+> End-to-bridge encryption requires the homeserver to support (and have enabled) [MSC2409](https://github.com/matrix-org/matrix-spec-proposals/pull/2409) and [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202). When using Synapse, the playbook turns on the experimental features this depends on (`msc2409_to_device_messages_enabled` and `msc3202_transaction_extensions`) for you. On other homeserver implementations, you need to arrange for this yourself.
 
 For each of the services (GitHub, GitLab, Jira, Figma, and generic webhooks) fill in the respective variables `matrix_bridge_hookshot_service_*` listed in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) as required.
 
diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 06143f6b4..2d39273bd 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -5161,9 +5161,21 @@ matrix_synapse_ext_synapse_http_antispam_config_enabled_callbacks: "{{ matrix_bo
 matrix_synapse_ext_synapse_http_antispam_config_fail_open: "{{ matrix_bot_draupnir_synapse_http_antispam_config_fail_open if matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled else (matrix_bot_meowlnir_synapse_http_antispam_config_fail_open if matrix_bot_meowlnir_synapse_http_antispam_enabled else {}) }}"
 matrix_synapse_ext_synapse_http_antispam_config_async: "{{ matrix_bot_draupnir_synapse_http_antispam_config_async if matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled else (matrix_bot_meowlnir_synapse_http_antispam_config_async if matrix_bot_meowlnir_synapse_http_antispam_enabled else {}) }}"
 
-# Meowlnir's bots need these to support end-to-end encryption.
-matrix_synapse_experimental_features_msc2409_to_device_messages_enabled: "{{ matrix_bot_meowlnir_enabled and matrix_bot_meowlnir_config_encryption_enable }}"
-matrix_synapse_experimental_features_msc3202_transaction_extensions_enabled: "{{ matrix_bot_meowlnir_enabled and matrix_bot_meowlnir_config_encryption_enable }}"
+# Meowlnir's bots and Hookshot need these to support end-to-end encryption.
+# Synapse only sends the extra data to appservices which ask for it in their registration file,
+# so enabling these affects no other component.
+matrix_synapse_experimental_features_msc2409_to_device_messages_enabled: |-
+  {{
+    (matrix_bot_meowlnir_enabled and matrix_bot_meowlnir_config_encryption_enable)
+    or
+    (matrix_bridge_hookshot_enabled and matrix_bridge_hookshot_encryption_enabled)
+  }}
+matrix_synapse_experimental_features_msc3202_transaction_extensions_enabled: |-
+  {{
+    (matrix_bot_meowlnir_enabled and matrix_bot_meowlnir_config_encryption_enable)
+    or
+    (matrix_bridge_hookshot_enabled and matrix_bridge_hookshot_encryption_enabled)
+  }}
 
 # Enable Synapse statistics reporting when using synapse-usage-exporter
 matrix_synapse_report_stats: "{{ matrix_synapse_usage_exporter_enabled }}"
diff --git a/roles/custom/matrix-bridge-hookshot/defaults/main.yml b/roles/custom/matrix-bridge-hookshot/defaults/main.yml
index 37d8ceb5c..d5026ec25 100644
--- a/roles/custom/matrix-bridge-hookshot/defaults/main.yml
+++ b/roles/custom/matrix-bridge-hookshot/defaults/main.yml
@@ -71,7 +71,7 @@ matrix_bridge_hookshot_cache_redisUri: "{{ ('redis://' + matrix_bridge_hookshot_
 # Controls whether the end-to-bridge encryption support is enabled.
 # This requires that:
 # - the homeserver to support MSC2409 (to-device messages for appservices) and MSC3202 (encryption-related appservice transaction extensions), and to have them enabled.
-#   These are typically experimental homeserver features which are disabled by default, so they usually need to be enabled explicitly via homeserver-specific configuration.
+#   These are typically experimental homeserver features which are disabled by default. Note that this is configured automatically by the playbook when encryption is enabled and the homeserver is Synapse.
 # - Hookshot to be pointed at a Redis instance via the `matrix_bridge_hookshot_cache_redis*` variables. Note that this is configured automatically by the playbook when encryption is enabled.
 # See: https://matrix-org.github.io/matrix-hookshot/latest/advanced/encryption.html
 # NOTE: Encryption is not currently (2025-12-30) supported when using MAS (https://github.com/matrix-org/matrix-hookshot/issues/1084)