diff --git a/tinc/tinc.conf.tmpl b/tinc/tinc.conf.tmpl
index f319096..ece10ce 100644
--- a/tinc/tinc.conf.tmpl
+++ b/tinc/tinc.conf.tmpl
@@ -22,7 +22,7 @@ AddressFamily = ${tinc_address_family:-any}
 # Default over-the-wire security for Lixonet.
 # Blowfish: https://en.wikipedia.org/wiki/Blowfish_(cipher)
 # SHA1: https://en.wikipedia.org/wiki/SHA-1
-Cipher = ${tinc_cipher:-blowfish}
+Cipher = ${tinc_cipher:-aes-256-cbc}
 Digest = ${tinc_digest:-sha1}
 
 # When this option is enabled, packets that cannot be sent directly to the