diff --git a/components/esp_driver_jpeg/jpeg_common.c b/components/esp_driver_jpeg/jpeg_common.c
index 5028c864442..d5c7ffdf6fc 100644
--- a/components/esp_driver_jpeg/jpeg_common.c
+++ b/components/esp_driver_jpeg/jpeg_common.c
@@ -23,6 +23,7 @@
 #include "esp_log.h"
 #include "esp_check.h"
 #include "hal/jpeg_periph.h"
+#include "esp_psram.h"
 #if JPEG_USE_RETENTION_LINK
 #include "esp_private/sleep_retention.h"
 #endif
@@ -257,3 +258,17 @@ esp_err_t jpeg_check_intr_priority(jpeg_codec_handle_t jpeg_codec, int intr_prio
     ESP_RETURN_ON_FALSE(!intr_priority_conflict, ESP_ERR_INVALID_STATE, TAG, "intr_priority conflict, already is %d but attempt to %d", jpeg_codec->intr_priority, intr_priority);
     return ret;
 }
+
+bool jpeg_check_dma2d_buffer(const void *buffer)
+{
+#if CONFIG_SECURE_FLASH_ENC_ENABLED
+    // jpeg cannot handle encrypted data.
+    if (esp_ptr_external_ram(buffer) && !esp_psram_ptr_is_no_enc(buffer)) {
+        return false;
+    }
+    if (esp_ptr_in_drom(buffer)) {
+        return false;
+    }
+#endif
+    return true;
+}
diff --git a/components/esp_driver_jpeg/jpeg_decode.c b/components/esp_driver_jpeg/jpeg_decode.c
index 6cdc70ee2fd..58b95ed2786 100644
--- a/components/esp_driver_jpeg/jpeg_decode.c
+++ b/components/esp_driver_jpeg/jpeg_decode.c
@@ -17,6 +17,7 @@
 #include "hal/cache_ll.h"
 #include "hal/cache_hal.h"
 #include "hal/jpeg_defs.h"
+#include "hal/hal_utils.h"
 #include "freertos/FreeRTOS.h"
 #include "freertos/queue.h"
 #include "freertos/semphr.h"
@@ -287,6 +288,10 @@ esp_err_t jpeg_decoder_process(jpeg_decoder_handle_t decoder_engine, const jpeg_
     ESP_RETURN_ON_FALSE(_check_buffer_alignment(decode_outbuf, outbuf_size, outbuf_cache_line_size), ESP_ERR_INVALID_ARG, TAG,
                         "jpeg decode decode_outbuf or out_buffer size is not aligned, please use jpeg_alloc_decoder_mem to malloc your buffer");
 
+    // both the bitstream and output buffer are accessed by the 2D-DMA
+    ESP_RETURN_ON_FALSE(jpeg_check_dma2d_buffer(bit_stream) && jpeg_check_dma2d_buffer(decode_outbuf), ESP_ERR_INVALID_ARG, TAG,
+                        "jpeg decode buffer is not 16-byte aligned or not in unencrypted PSRAM, please use jpeg_alloc_decoder_mem to malloc your buffer");
+
     esp_err_t ret = ESP_OK;
 
 #if CONFIG_PM_ENABLE
@@ -435,15 +440,21 @@ void *jpeg_alloc_decoder_mem(size_t size, const jpeg_decode_memory_alloc_cfg_t *
        FOr input buffer(for decoder is PSRAM write to 2DDMA), no restriction for any align (both cache writeback and requirement from 2DDMA).
     */
     size_t cache_align = 0;
+    size_t buffer_align = 0;
     esp_cache_get_alignment(MALLOC_CAP_SPIRAM, &cache_align);
-    if (mem_cfg->buffer_direction == JPEG_DEC_ALLOC_OUTPUT_BUFFER) {
-        size = ESP_ALIGN_UP(size, cache_align);
-        *allocated_size = size;
-        return heap_caps_aligned_calloc(cache_align, 1, size, MALLOC_CAP_SPIRAM);
-    } else {
-        *allocated_size = size;
-        return heap_caps_calloc(1, size, MALLOC_CAP_SPIRAM);
+    buffer_align = MAX(cache_align, JPEG_DMA2D_BUFFER_ALIGN);
+    size = ESP_ALIGN_UP(size, buffer_align);
+    *allocated_size = size;
+    // To simplify the logic, we always use the LCM of cache and 2D-DMA alignment to satisfy both requirements
+    void *buffer = heap_caps_aligned_calloc(buffer_align, 1, size, JPEG_SPIRAM_ALLOC_CAPS);
+    if (buffer == NULL) {
+#if CONFIG_SPIRAM_ENC_EXEMPT
+        ESP_LOGE(TAG, "no mem for %zu bytes decode buffer in unencrypted PSRAM, please enlarge CONFIG_SPIRAM_ENC_EXEMPT_SIZE", size);
+#else
+        ESP_LOGE(TAG, "no mem for %zu bytes decode buffer", size);
+#endif
     }
+    return buffer;
 }
 
 /****************************************************************
diff --git a/components/esp_driver_jpeg/jpeg_encode.c b/components/esp_driver_jpeg/jpeg_encode.c
index 41749189da8..4d0a624b6bd 100644
--- a/components/esp_driver_jpeg/jpeg_encode.c
+++ b/components/esp_driver_jpeg/jpeg_encode.c
@@ -19,6 +19,7 @@
 #include "hal/jpeg_ll.h"
 #include "hal/cache_hal.h"
 #include "hal/cache_ll.h"
+#include "hal/hal_utils.h"
 #include "esp_private/dma2d.h"
 #include "jpeg_private.h"
 #include "driver/jpeg_encode.h"
@@ -175,6 +176,8 @@ esp_err_t jpeg_encoder_process(jpeg_encoder_handle_t encoder_engine, const jpeg_
     ESP_RETURN_ON_FALSE(bit_stream, ESP_ERR_INVALID_ARG, TAG, "jpeg encode output buffer is null");
     ESP_RETURN_ON_FALSE(out_size, ESP_ERR_INVALID_ARG, TAG, "jpeg encode picture out_size is null");
     ESP_RETURN_ON_FALSE(((uintptr_t)bit_stream % cache_hal_get_cache_line_size(CACHE_LL_LEVEL_EXT_MEM, CACHE_TYPE_DATA)) == 0, ESP_ERR_INVALID_ARG, TAG, "jpeg encode bit stream is not aligned, please use jpeg_alloc_encoder_mem to malloc your buffer");
+    // both the input picture and output bitstream are accessed by the 2D-DMA
+    ESP_RETURN_ON_FALSE(jpeg_check_dma2d_buffer(encode_inbuf) && jpeg_check_dma2d_buffer(bit_stream), ESP_ERR_INVALID_ARG, TAG, "jpeg encode buffer is not 16-byte aligned or not in unencrypted PSRAM, please use jpeg_alloc_encoder_mem to malloc your buffer");
 
     esp_err_t ret = ESP_OK;
 
@@ -401,15 +404,21 @@ void *jpeg_alloc_encoder_mem(size_t size, const jpeg_encode_memory_alloc_cfg_t *
        For input buffer(for decoder is PSRAM write to 2DDMA), no restriction for any align (both cache writeback and requirement from 2DDMA).
     */
     size_t cache_align = 0;
+    size_t buffer_align = 0;
     esp_cache_get_alignment(MALLOC_CAP_SPIRAM, &cache_align);
-    if (mem_cfg->buffer_direction == JPEG_ENC_ALLOC_OUTPUT_BUFFER) {
-        size = ESP_ALIGN_UP(size, cache_align);
-        *allocated_size = size;
-        return heap_caps_aligned_calloc(cache_align, 1, size, MALLOC_CAP_SPIRAM);
-    } else {
-        *allocated_size = size;
-        return heap_caps_calloc(1, size, MALLOC_CAP_SPIRAM);
+    buffer_align = MAX(cache_align, JPEG_DMA2D_BUFFER_ALIGN);
+    size = ESP_ALIGN_UP(size, buffer_align);
+    *allocated_size = size;
+    // To simplify the logic, we always use the LCM of cache and 2D-DMA alignment to satisfy both requirements
+    void *buffer = heap_caps_aligned_calloc(buffer_align, 1, size, JPEG_SPIRAM_ALLOC_CAPS);
+    if (buffer == NULL) {
+#if CONFIG_SPIRAM_ENC_EXEMPT
+        ESP_LOGE(TAG, "no mem for %zu bytes encode buffer in unencrypted PSRAM, please enlarge CONFIG_SPIRAM_ENC_EXEMPT_SIZE", size);
+#else
+        ESP_LOGE(TAG, "no mem for %zu bytes encode buffer", size);
+#endif
     }
+    return buffer;
 }
 
 /****************************************************************
diff --git a/components/esp_driver_jpeg/jpeg_private.h b/components/esp_driver_jpeg/jpeg_private.h
index 7c9f187e50f..1b0838050a0 100644
--- a/components/esp_driver_jpeg/jpeg_private.h
+++ b/components/esp_driver_jpeg/jpeg_private.h
@@ -31,6 +31,18 @@ extern "C" {
 // JPEG encoder and decoder shares same interrupt ID.
 #define JPEG_INTR_ALLOC_FLAG              (ESP_INTR_FLAG_SHARED)
 
+// Buffers fed to the 2D-DMA must be at least 16-byte aligned.
+#define JPEG_DMA2D_BUFFER_ALIGN           16
+
+// The JPEG codec cannot work with encrypted buffer, because it deals with macro block. When an
+// unencrypted PSRAM region is reserved (CONFIG_SPIRAM_ENC_EXEMPT), codec buffers
+// must come from it; otherwise use normal PSRAM.
+#if CONFIG_SPIRAM_ENC_EXEMPT
+#define JPEG_SPIRAM_ALLOC_CAPS            (MALLOC_CAP_SPIRAM_NO_ENC)
+#else
+#define JPEG_SPIRAM_ALLOC_CAPS            (MALLOC_CAP_SPIRAM)
+#endif
+
 // Use retention link only when the target supports sleep retention and PM is enabled
 #define JPEG_USE_RETENTION_LINK  (CONFIG_PM_ENABLE && CONFIG_PM_POWER_DOWN_PERIPHERAL_IN_LIGHT_SLEEP)
 
@@ -250,6 +262,18 @@ esp_err_t jpeg_isr_deregister(jpeg_codec_handle_t jpeg_codec, jpeg_isr_handler_t
  */
 esp_err_t jpeg_check_intr_priority(jpeg_codec_handle_t jpeg_codec, int intr_priority);
 
+/**
+ * @brief Validate a user buffer that will be accessed by the 2D-DMA
+ *
+ * The buffer must be 16-byte aligned. When CONFIG_SPIRAM_ENC_EXEMPT is enabled,
+ * a PSRAM buffer must reside in the unencrypted carve-out, since the 2D-DMA
+ * cannot access encrypted PSRAM. Internal RAM buffers are always accepted.
+ *
+ * @param buffer Buffer pointer provided by the user
+ * @return true if the buffer can be used by the 2D-DMA, false otherwise
+ */
+bool jpeg_check_dma2d_buffer(const void *buffer);
+
 /**
  * @brief Create sleep retention link
  *
diff --git a/components/esp_psram/system_layer/esp_psram.c b/components/esp_psram/system_layer/esp_psram.c
index e511fb6b05d..3ba5b188c49 100644
--- a/components/esp_psram/system_layer/esp_psram.c
+++ b/components/esp_psram/system_layer/esp_psram.c
@@ -19,6 +19,7 @@
 #include "freertos/FreeRTOS.h"
 #include "esp_heap_caps_init.h"
 #include "esp_psram.h"
+#include "esp_macros.h"
 #include "esp_mmu_map.h"
 #include "hal/mmu_hal.h"
 #include "hal/mmu_ll.h"
@@ -288,7 +289,7 @@ static void s_psram_mapping(uint32_t psram_available_size, uint32_t start_page)
 {
     esp_err_t ret = ESP_FAIL;
 #if CONFIG_SPIRAM_ENC_EXEMPT
-    size_t enc_exempt_size = ALIGN_UP_BY((size_t)CONFIG_SPIRAM_ENC_EXEMPT_SIZE * 1024, MMU_PAGE_SIZE);
+    size_t enc_exempt_size = ESP_ALIGN_UP((size_t)CONFIG_SPIRAM_ENC_EXEMPT_SIZE * 1024, MMU_PAGE_SIZE);
     if (enc_exempt_size >= psram_available_size) {
         ESP_EARLY_LOGE(TAG, "SPIRAM_ENC_EXEMPT_SIZE (%dKB) >= available PSRAM (%dKB); disabling carve-out",
                        (int)(enc_exempt_size / 1024), (int)(psram_available_size / 1024));
diff --git a/components/hal/esp32s31/include/hal/mmu_ll.h b/components/hal/esp32s31/include/hal/mmu_ll.h
index 2d2da4ed516..1a226353541 100644
--- a/components/hal/esp32s31/include/hal/mmu_ll.h
+++ b/components/hal/esp32s31/include/hal/mmu_ll.h
@@ -587,6 +587,24 @@ static inline uint32_t mmu_ll_entry_id_to_vaddr_base(uint32_t mmu_id, uint32_t e
     return mmu_ll_laddr_to_vaddr(laddr, type, (mmu_id == MMU_LL_FLASH_MMU_ID) ? MMU_TARGET_FLASH0 : MMU_TARGET_PSRAM0);
 }
 
+/**
+ * Write a PSRAM MMU entry without the SENSITIVE bit, used only for the
+ * carved-out unencrypted region (see CONFIG_SPIRAM_ENC_EXEMPT).
+ *
+ * No anti-FI check: the SENSITIVE bit is intentionally clear, and an FI flip
+ * that sets it would force decryption of plaintext data (garbage, fails safe).
+ */
+__attribute__((always_inline)) static inline void mmu_ll_write_entry_no_enc(uint32_t mmu_id, uint32_t entry_id, uint32_t mmu_val)
+{
+    HAL_ASSERT(mmu_id == MMU_LL_PSRAM_MMU_ID);
+
+    mmu_val |= SOC_MMU_PSRAM_VALID;
+    mmu_val |= SOC_MMU_ACCESS_PSRAM;
+
+    REG_WRITE(SPI_MEM_S_MMU_ITEM_INDEX_REG, entry_id);
+    REG_WRITE(SPI_MEM_S_MMU_ITEM_CONTENT_REG, mmu_val);
+}
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/components/soc/esp32s31/include/soc/Kconfig.soc_caps.in b/components/soc/esp32s31/include/soc/Kconfig.soc_caps.in
index 89904df02fc..2aa6866af9e 100644
--- a/components/soc/esp32s31/include/soc/Kconfig.soc_caps.in
+++ b/components/soc/esp32s31/include/soc/Kconfig.soc_caps.in
@@ -1255,6 +1255,10 @@ config SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX
     int
     default 64
 
+config SOC_PSRAM_ENCRYPTION_PAGE_CONFIGURABLE
+    bool
+    default y
+
 config SOC_RECOVERY_BOOTLOADER_SUPPORTED
     bool
     default y
diff --git a/components/soc/esp32s31/include/soc/soc_caps.h b/components/soc/esp32s31/include/soc/soc_caps.h
index d16780d9dfb..bc5829067d0 100644
--- a/components/soc/esp32s31/include/soc/soc_caps.h
+++ b/components/soc/esp32s31/include/soc/soc_caps.h
@@ -467,6 +467,9 @@
 #define SOC_FLASH_ENCRYPTION_XTS_AES_SUPPORT_PSEUDO_ROUND  1
 #define SOC_FLASH_ENCRYPTED_XTS_AES_BLOCK_MAX   (64)
 
+/*-------------------------- PSRAM Encryption CAPS----------------------------*/
+#define SOC_PSRAM_ENCRYPTION_PAGE_CONFIGURABLE  1  /* PSRAM encryption can be configured on a MMU page basis */
+
 /*------------------------Bootloader CAPS---------------------------------*/
 /* Support Recovery Bootloader */
 #define SOC_RECOVERY_BOOTLOADER_SUPPORTED             (1)
diff --git a/docs/en/api-reference/peripherals/jpeg.rst b/docs/en/api-reference/peripherals/jpeg.rst
index ebb1914eb36..48d938ae5b1 100644
--- a/docs/en/api-reference/peripherals/jpeg.rst
+++ b/docs/en/api-reference/peripherals/jpeg.rst
@@ -25,6 +25,7 @@ This document covers the following sections:
 -  :ref:`jpeg-pixel-storage-layout` - covers color space order overview required in this JPEG decoder and encoder.
 -  :ref:`jpeg-thread-safety` - lists which APIs are guaranteed to be thread safe by the driver.
 -  :ref:`jpeg-power-management` - describes how JPEG driver would be affected by power consumption.
+-  :ref:`jpeg-flash-encryption` - describes how to use the JPEG codec correctly when flash/PSRAM encryption is enabled.
 -  :ref:`jpeg-kconfig-options` - lists the supported Kconfig options that can bring different effects to the driver.
 
 .. _jpeg-resource-allocation:
@@ -568,6 +569,24 @@ When power management is enabled (i.e., :ref:`CONFIG_PM_ENABLE` is set), the sys
 
 Whenever the user is decoding or encoding via JPEG (i.e., calling :cpp:func:`jpeg_encoder_process` or :cpp:func:`jpeg_decoder_process`), the driver guarantees that the power management lock is acquired by setting it to :cpp:enumerator:`esp_pm_lock_type_t::ESP_PM_CPU_FREQ_MAX`. Once the encoding or decoding is finished, the driver releases the lock and the system can enter Light-sleep.
 
+.. _jpeg-flash-encryption:
+
+Usage Under Encryption
+^^^^^^^^^^^^^^^^^^^^^^
+
+The JPEG codec moves data via the 2D-DMA, and the JPEG codec **cannot process encrypted data**. Therefore, when PSRAM encryption is enabled, the JPEG input/output buffers must reside in an unencrypted memory region, otherwise encoding/decoding fails.
+
+To support the encrypted scenario, the driver does the following:
+
+- When ``CONFIG_SPIRAM_ENC_EXEMPT`` is enabled, :cpp:func:`jpeg_alloc_decoder_mem` and :cpp:func:`jpeg_alloc_encoder_mem` allocate buffers from the unencrypted PSRAM region (``MALLOC_CAP_SPIRAM_NO_ENC``) automatically.
+- The allocated buffers satisfy both the cache line alignment and the byte alignment required by the 2D-DMA.
+
+Please note the following when using it:
+
+1. It is recommended to always allocate buffers via :cpp:func:`jpeg_alloc_encoder_mem` / :cpp:func:`jpeg_alloc_decoder_mem` to ensure correct alignment and memory region.
+
+2. The size of the unencrypted region is determined by ``CONFIG_SPIRAM_ENC_EXEMPT_SIZE``. Since the JPEG buffer size depends on the image resolution and cannot be predicted automatically, configure it according to the largest image you actually process. If the region is insufficient, the allocation fails and an error log is printed, suggesting to enlarge ``CONFIG_SPIRAM_ENC_EXEMPT_SIZE``. Also note that this value must not be greater than or equal to the actual PSRAM size, otherwise the unencrypted region is disabled.
+
 .. _jpeg-kconfig-options:
 
 Kconfig Options
diff --git a/docs/zh_CN/api-reference/peripherals/jpeg.rst b/docs/zh_CN/api-reference/peripherals/jpeg.rst
index bd445e72610..f53c1e35cd4 100644
--- a/docs/zh_CN/api-reference/peripherals/jpeg.rst
+++ b/docs/zh_CN/api-reference/peripherals/jpeg.rst
@@ -25,6 +25,7 @@ JPEG 常用于数字图像，尤其是数码摄影图像的有损压缩。压缩
 - :ref:`jpeg-pixel-storage-layout`，涵盖了 JPEG 解码器和编码器所需的颜色空间顺序。
 - :ref:`jpeg-thread-safety`，列出了驱动程序能保证线程安全的 API。
 - :ref:`jpeg-power-management`，描述了影响 JPEG 驱动程序功耗的因素。
+- :ref:`jpeg-flash-encryption`，介绍了在 flash/PSRAM 加密场景下如何正确使用 JPEG 编解码器。
 - :ref:`jpeg-kconfig-options`，列出了支持的 Kconfig 选项，可以为驱动程序带来不同的效果。
 
 .. _jpeg-resource-allocation:
@@ -568,6 +569,24 @@ YUV420
 
 每当用户通过 JPEG 进行解码或编码（即调用 :cpp:func:`jpeg_encoder_process` 或 :cpp:func:`jpeg_decoder_process`）时，驱动程序会将电源管理设定为 :cpp:enumerator:`esp_pm_lock_type_t::ESP_PM_CPU_FREQ_MAX`，确保获取电源管理锁。一旦编码或解码完成，驱动程序将释放锁，则系统可以进入 Light-sleep 模式。
 
+.. _jpeg-flash-encryption:
+
+加密场景下的使用
+^^^^^^^^^^^^^^^^
+
+JPEG 编解码器通过 2D-DMA 搬运数据，而 JPEG 编解码器 **无法处理已加密的数据**。因此在开启 PSRAM 加密时，需要让 JPEG 的输入/输出缓冲区位于非加密的内存区域，否则编解码会失败。
+
+为支持加密场景，驱动程序做了如下处理：
+
+- 当启用 ``CONFIG_SPIRAM_ENC_EXEMPT`` 时， :cpp:func:`jpeg_alloc_decoder_mem` 和 :cpp:func:`jpeg_alloc_encoder_mem` 会自动从非加密 PSRAM 区域（``MALLOC_CAP_SPIRAM_NO_ENC``）分配缓冲区。
+- 分配的缓冲区会同时满足 cache 行对齐与 2D-DMA 的字节对齐要求。
+
+使用时请注意：
+
+1. 建议始终通过 :cpp:func:`jpeg_alloc_encoder_mem` / :cpp:func:`jpeg_alloc_decoder_mem` 分配缓冲区，以保证对齐与内存区域正确。
+
+2. 非加密区的大小由 ``CONFIG_SPIRAM_ENC_EXEMPT_SIZE`` 决定。由于 JPEG 缓冲区大小取决于图像分辨率，无法自动预测，需根据实际处理的最大图像自行配置。若该区域不足，分配会失败并打印错误日志，提示增大 ``CONFIG_SPIRAM_ENC_EXEMPT_SIZE``；同时注意该值不能大于等于实际 PSRAM 容量，否则非加密区会被禁用。
+
 .. _jpeg-kconfig-options:
 
 Kconfig 选项
diff --git a/examples/peripherals/jpeg/jpeg_decode/main/jpeg_decode_example_main.c b/examples/peripherals/jpeg/jpeg_decode/main/jpeg_decode_example_main.c
index 9f26376e144..1ab1c07be6a 100644
--- a/examples/peripherals/jpeg/jpeg_decode/main/jpeg_decode_example_main.c
+++ b/examples/peripherals/jpeg/jpeg_decode/main/jpeg_decode_example_main.c
@@ -8,6 +8,8 @@
 #include <inttypes.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
+#include "sdkconfig.h"
 #include "freertos/FreeRTOS.h"
 #include "freertos/task.h"
 #include "driver/jpeg_decode.h"
@@ -55,6 +57,7 @@ void app_main(void)
     const size_t embedded_size = example_jpeg_end - example_jpeg_start;
     jpeg_decoder_handle_t jpeg_handle = NULL;
     uint8_t *decoded_pixels = NULL;
+    uint8_t *input_buf = NULL;
     unsigned char *encoded = NULL;
 
     printf("Loading embedded JPEG from flash...\n");
@@ -97,12 +100,25 @@ void app_main(void)
         .rgb_order = JPEG_DEC_RGB_ELEMENT_ORDER_BGR,
     };
 
+    /* jpeg don't handle the encrypted data.*/
+    const uint8_t *bit_stream = example_jpeg_start;
+#if CONFIG_SECURE_FLASH_ENC_ENABLED
+    size_t input_buffer_size = 0;
+    jpeg_decode_memory_alloc_cfg_t in_mem_cfg = {
+        .buffer_direction = JPEG_DEC_ALLOC_INPUT_BUFFER,
+    };
+    input_buf = (uint8_t *)jpeg_alloc_decoder_mem(embedded_size, &in_mem_cfg, &input_buffer_size);
+    assert(input_buf != NULL);
+    memcpy(input_buf, example_jpeg_start, embedded_size);
+    bit_stream = input_buf;
+#endif
+
     uint32_t decoded_size = 0;
     printf("Decoding JPEG -> RGB888...\n");
     ESP_ERROR_CHECK(jpeg_decoder_process(
                         jpeg_handle,
                         &decode_cfg,
-                        example_jpeg_start, // jpeg decoder can read directly from flash, no need to copy to RAM first
+                        bit_stream,
                         embedded_size,
                         decoded_pixels,
                         decoded_buffer_size,
@@ -134,4 +150,5 @@ void app_main(void)
     ESP_ERROR_CHECK(jpeg_del_decoder_engine(jpeg_handle));
     free(encoded);
     free(decoded_pixels);
+    free(input_buf);
 }
diff --git a/examples/peripherals/jpeg/jpeg_decode/pytest_jpeg_decode.py b/examples/peripherals/jpeg/jpeg_decode/pytest_jpeg_decode.py
index d810100aee8..8e5cd75774a 100644
--- a/examples/peripherals/jpeg/jpeg_decode/pytest_jpeg_decode.py
+++ b/examples/peripherals/jpeg/jpeg_decode/pytest_jpeg_decode.py
@@ -194,9 +194,7 @@ def assert_image_matches_golden(result_image: RgbImage, golden_path: Path) -> No
     )
 
 
-@pytest.mark.generic
-@idf_parametrize('target', soc_filtered_targets('SOC_JPEG_DECODE_SUPPORTED == 1'), indirect=['target'])
-def test_jpeg_decode_example(dut: Dut) -> None:
+def run_jpeg_decode_example(dut: Dut) -> None:
     dut.expect_exact('Loading embedded JPEG from flash...')
     dut.expect(r'Embedded JPEG size: \d+ bytes')
     dut.expect(r'JPEG header parsed: width=\d+ height=\d+')
@@ -216,3 +214,26 @@ def test_jpeg_decode_example(dut: Dut) -> None:
     output_path = Path(dut.logdir) / DECODE_OUTPUT_NAME
     save_ppm_artifact(result_image, output_path)
     assert_image_matches_golden(result_image, GOLDEN_OUTPUT_PATH)
+
+
+@pytest.mark.generic
+@idf_parametrize('target', soc_filtered_targets('SOC_JPEG_DECODE_SUPPORTED == 1'), indirect=['target'])
+def test_jpeg_decode_example(dut: Dut) -> None:
+    run_jpeg_decode_example(dut)
+
+
+@pytest.mark.flash_encryption
+@pytest.mark.parametrize(
+    'config',
+    [
+        'flash_enc',
+    ],
+    indirect=True,
+)
+@idf_parametrize(
+    'target',
+    soc_filtered_targets('SOC_JPEG_DECODE_SUPPORTED == 1 and SOC_FLASH_ENC_SUPPORTED == 1'),
+    indirect=['target'],
+)
+def test_jpeg_decode_example_with_flash_encryption(dut: Dut) -> None:
+    run_jpeg_decode_example(dut)
diff --git a/examples/peripherals/jpeg/jpeg_decode/sdkconfig.ci.default b/examples/peripherals/jpeg/jpeg_decode/sdkconfig.ci.default
new file mode 100644
index 00000000000..f70e1f1910d
--- /dev/null
+++ b/examples/peripherals/jpeg/jpeg_decode/sdkconfig.ci.default
@@ -0,0 +1 @@
+# Default CI build, inherits sdkconfig.defaults
diff --git a/examples/peripherals/jpeg/jpeg_decode/sdkconfig.ci.flash_enc b/examples/peripherals/jpeg/jpeg_decode/sdkconfig.ci.flash_enc
new file mode 100644
index 00000000000..2412c23e67a
--- /dev/null
+++ b/examples/peripherals/jpeg/jpeg_decode/sdkconfig.ci.flash_enc
@@ -0,0 +1,7 @@
+CONFIG_PARTITION_TABLE_OFFSET=0x9000
+CONFIG_SECURE_FLASH_ENC_ENABLED=y
+CONFIG_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT=y
+CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC=y
+CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED=y
+CONFIG_SPIRAM_ENC_EXEMPT=y
+CONFIG_SPIRAM_ENC_EXEMPT_SIZE=4096
diff --git a/examples/peripherals/jpeg/jpeg_encode/main/jpeg_encode_example_main.c b/examples/peripherals/jpeg/jpeg_encode/main/jpeg_encode_example_main.c
index 3dbadaae07d..b41b7699014 100644
--- a/examples/peripherals/jpeg/jpeg_encode/main/jpeg_encode_example_main.c
+++ b/examples/peripherals/jpeg/jpeg_encode/main/jpeg_encode_example_main.c
@@ -8,6 +8,7 @@
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include "mbedtls/base64.h"
 #include "esp_check.h"
 #include "driver/jpeg_encode.h"
@@ -44,6 +45,7 @@ void app_main(void)
     const size_t embedded_size = esp720p_rgb_end - esp720p_rgb_start;
     uint32_t jpeg_size = 0;
     jpeg_encoder_handle_t jpeg_handle = NULL;
+    uint8_t *rgb_buf = NULL;
 
     printf("Loading embedded BGR24 image from flash...\n");
     printf("Embedded raw image size: %zu bytes\n", embedded_size);
@@ -60,6 +62,18 @@ void app_main(void)
         .height = EXAMPLE_HEIGHT,
     };
 
+    const uint8_t *rgb_src = esp720p_rgb_start;
+#if CONFIG_SECURE_FLASH_ENC_ENABLED
+    size_t input_buffer_size = 0;
+    jpeg_encode_memory_alloc_cfg_t rx_mem_cfg = {
+        .buffer_direction = JPEG_ENC_ALLOC_INPUT_BUFFER,
+    };
+    rgb_buf = (uint8_t *)jpeg_alloc_encoder_mem(EXAMPLE_RGB_FRAME_SIZE, &rx_mem_cfg, &input_buffer_size);
+    assert(rgb_buf != NULL);
+    memcpy(rgb_buf, esp720p_rgb_start, EXAMPLE_RGB_FRAME_SIZE);
+    rgb_src = rgb_buf;
+#endif
+
     size_t result_buffer_size = 0;
     /* The output JPEG is compressed, so the example does not need to reserve
      * a full raw-frame worth of space for the bitstream. This 10:1 estimate
@@ -78,9 +92,8 @@ void app_main(void)
     };
     ESP_ERROR_CHECK(jpeg_new_encoder_engine(&encode_eng_cfg, &jpeg_handle));
 
-    printf("JPEG encoder will read the embedded raw buffer directly from flash.\n");
     printf("Encoding BGR24(raw) -> JPEG...\n");
-    ESP_ERROR_CHECK(jpeg_encoder_process(jpeg_handle, &enc_config, esp720p_rgb_start, EXAMPLE_RGB_FRAME_SIZE,
+    ESP_ERROR_CHECK(jpeg_encoder_process(jpeg_handle, &enc_config, rgb_src, EXAMPLE_RGB_FRAME_SIZE,
                                          jpeg_buf, result_buffer_size, &jpeg_size));
     printf("Encoded JPEG size: %" PRIu32 " bytes\n", jpeg_size);
 
@@ -103,4 +116,5 @@ void app_main(void)
     ESP_ERROR_CHECK(jpeg_del_encoder_engine(jpeg_handle));
     free(encoded);
     free(jpeg_buf);
+    free(rgb_buf);
 }
diff --git a/examples/peripherals/jpeg/jpeg_encode/pytest_jpeg_encode.py b/examples/peripherals/jpeg/jpeg_encode/pytest_jpeg_encode.py
index 2fc8541e311..8b631f8b882 100644
--- a/examples/peripherals/jpeg/jpeg_encode/pytest_jpeg_encode.py
+++ b/examples/peripherals/jpeg/jpeg_encode/pytest_jpeg_encode.py
@@ -111,12 +111,9 @@ def assert_jpeg_matches_golden(result_bytes: bytes, golden_path: Path) -> None:
     )
 
 
-@pytest.mark.generic
-@idf_parametrize('target', soc_filtered_targets('SOC_JPEG_ENCODE_SUPPORTED == 1'), indirect=['target'])
-def test_jpeg_encode_example(dut: Dut) -> None:
+def run_jpeg_encode_example(dut: Dut) -> None:
     dut.expect_exact('Loading embedded BGR24 image from flash...')
     dut.expect(r'Embedded raw image size: \d+ bytes')
-    dut.expect_exact('JPEG encoder will read the embedded raw buffer directly from flash.')
     dut.expect_exact('Encoding BGR24(raw) -> JPEG...')
     dut.expect(r'Encoded JPEG size: \d+ bytes')
 
@@ -132,3 +129,26 @@ def test_jpeg_encode_example(dut: Dut) -> None:
     assert_jpeg_matches_golden(jpeg_bytes, GOLDEN_IMAGE_PATH)
 
     dut.expect_exact('JPEG encode demo done.')
+
+
+@pytest.mark.generic
+@idf_parametrize('target', soc_filtered_targets('SOC_JPEG_ENCODE_SUPPORTED == 1'), indirect=['target'])
+def test_jpeg_encode_example(dut: Dut) -> None:
+    run_jpeg_encode_example(dut)
+
+
+@pytest.mark.flash_encryption
+@pytest.mark.parametrize(
+    'config',
+    [
+        'flash_enc',
+    ],
+    indirect=True,
+)
+@idf_parametrize(
+    'target',
+    soc_filtered_targets('SOC_JPEG_ENCODE_SUPPORTED == 1 and SOC_FLASH_ENC_SUPPORTED == 1'),
+    indirect=['target'],
+)
+def test_jpeg_encode_example_with_flash_encryption(dut: Dut) -> None:
+    run_jpeg_encode_example(dut)
diff --git a/examples/peripherals/jpeg/jpeg_encode/sdkconfig.ci.default b/examples/peripherals/jpeg/jpeg_encode/sdkconfig.ci.default
new file mode 100644
index 00000000000..f70e1f1910d
--- /dev/null
+++ b/examples/peripherals/jpeg/jpeg_encode/sdkconfig.ci.default
@@ -0,0 +1 @@
+# Default CI build, inherits sdkconfig.defaults
diff --git a/examples/peripherals/jpeg/jpeg_encode/sdkconfig.ci.flash_enc b/examples/peripherals/jpeg/jpeg_encode/sdkconfig.ci.flash_enc
new file mode 100644
index 00000000000..2412c23e67a
--- /dev/null
+++ b/examples/peripherals/jpeg/jpeg_encode/sdkconfig.ci.flash_enc
@@ -0,0 +1,7 @@
+CONFIG_PARTITION_TABLE_OFFSET=0x9000
+CONFIG_SECURE_FLASH_ENC_ENABLED=y
+CONFIG_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT=y
+CONFIG_SECURE_FLASH_UART_BOOTLOADER_ALLOW_ENC=y
+CONFIG_SECURE_FLASH_REQUIRE_ALREADY_ENABLED=y
+CONFIG_SPIRAM_ENC_EXEMPT=y
+CONFIG_SPIRAM_ENC_EXEMPT_SIZE=4096