diff --git a/fast/stages-aw/3-security/core-dev.tf b/fast/stages-aw/3-security/core-dev.tf
index 0a34b6eb2..b8fdfd99f 100644
--- a/fast/stages-aw/3-security/core-dev.tf
+++ b/fast/stages-aw/3-security/core-dev.tf
@@ -54,10 +54,6 @@ module "dev-sec-kms" {
   keyring = {
     location = each.key
     name     = "dev-${each.key}"
-    version_template = {
-      algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
-      protection_level = var.kms_protection_level
-    }
   }
   keys = local.kms_locations_keys[each.key]
 }
diff --git a/fast/stages-aw/3-security/core-prod.tf b/fast/stages-aw/3-security/core-prod.tf
index 318525eb2..9e7a55041 100644
--- a/fast/stages-aw/3-security/core-prod.tf
+++ b/fast/stages-aw/3-security/core-prod.tf
@@ -53,10 +53,6 @@ module "prod-sec-kms" {
   keyring = {
     location = each.key
     name     = "prod-${each.key}"
-    version_template = {
-      algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
-      protection_level = var.kms_protection_level
-    }
   }
   keys = local.kms_locations_keys[each.key]
 }
diff --git a/fast/stages-aw/3-security/main.tf b/fast/stages-aw/3-security/main.tf
index a72bd7b78..88365d6b6 100644
--- a/fast/stages-aw/3-security/main.tf
+++ b/fast/stages-aw/3-security/main.tf
@@ -39,11 +39,26 @@ locals {
     for k, v in var.kms_keys : v.locations
   ]))
   # map { location -> { key_name -> key_details } }
+  # Keys that do not set their own version_template inherit the stage-wide
+  # protection level here. modules/kms only honours version_template per key
+  # (its keyring object is {location, name}), so this is the only place the
+  # stage can apply var.kms_protection_level.
   kms_locations_keys = {
     for loc in local.kms_locations :
     loc => {
       for k, v in var.kms_keys :
-      k => v
+      k => merge(v, {
+        version_template = (
+          v.version_template != null
+          ? v.version_template
+          : var.kms_protection_level == null
+          ? null
+          : {
+            algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
+            protection_level = var.kms_protection_level
+          }
+        )
+      })
       if contains(v.locations, loc)
     }
   }
diff --git a/fast/stages-aw/3-security/variables.tf b/fast/stages-aw/3-security/variables.tf
index 7206afa28..afb3bf412 100644
--- a/fast/stages-aw/3-security/variables.tf
+++ b/fast/stages-aw/3-security/variables.tf
@@ -111,7 +111,7 @@ variable "kms_keys" {
 }
 
 variable "kms_protection_level" {
-  description = "KMS protection level."
+  description = "Protection level (HSM or SOFTWARE) applied to every key in kms_keys that does not set its own version_template."
   type        = string
   nullable    = true
 }