diff --git a/CMakeLists.txt b/CMakeLists.txt
index e4b1b26..4dad7fc 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -92,6 +92,9 @@ if (CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
   target_sources(moonlight PRIVATE ./src/audio/oss.c)
 endif()
 
+check_c_source_compiles("#include <sys/auxv.h>
+                         int main(void) { return getauxval(AT_HWCAP); }" HAVE_GETAUXVAL)
+
 if (CEC_FOUND)
   list(APPEND MOONLIGHT_DEFINITIONS HAVE_LIBCEC)
   list(APPEND MOONLIGHT_OPTIONS CEC)
diff --git a/src/config.c b/src/config.c
index df13cad..8bd8d2a 100644
--- a/src/config.c
+++ b/src/config.c
@@ -348,7 +348,14 @@ void config_parse(int argc, char* argv[], PCONFIGURATION config) {
   config->stream.streamingRemotely = STREAM_CFG_AUTO;
   config->stream.audioConfiguration = AUDIO_CONFIGURATION_STEREO;
   config->stream.supportedVideoFormats = SCM_H264;
-  config->stream.encryptionFlags = ENCFLG_AUDIO;
+
+  // Opt in for video encryption if the CPU has good AES performance
+  if (has_fast_aes()) {
+    config->stream.encryptionFlags = ENCFLG_ALL;
+  }
+  else {
+    config->stream.encryptionFlags = ENCFLG_AUDIO;
+  }
 
 #ifdef __arm__
   char cpuinfo[4096] = {};
@@ -358,7 +365,7 @@ void config_parse(int argc, char* argv[], PCONFIGURATION config) {
     // barely handle Opus decoding alone.
     if (strstr(cpuinfo, "ARMv6")) {
       config->stream.encryptionFlags = ENCFLG_NONE;
-      printf("Disabling audio encryption on low performance CPU\n");
+      printf("Disabling encryption on low performance CPU\n");
     }
   }
 #endif
diff --git a/src/util.c b/src/util.c
index b6442ba..08f3721 100644
--- a/src/util.c
+++ b/src/util.c
@@ -26,6 +26,14 @@
 #include <unistd.h>
 #include <stdlib.h>
 
+#ifdef HAVE_GETAUXVAL
+#include <sys/auxv.h>
+
+#ifndef HWCAP2_AES
+#define HWCAP2_AES (1 << 0)
+#endif
+#endif
+
 int write_bool(char *path, bool val) {
   int fd = open(path, O_RDWR);
 
@@ -63,4 +71,34 @@ bool ensure_buf_size(void **buf, size_t *buf_size, size_t required_size) {
   }
 
   return true;
+}
+
+bool has_fast_aes() {
+#ifndef __has_builtin
+#define __has_builtin(x) 0
+#endif
+
+#if defined(HAVE_GETAUXVAL) && (defined(__arm__) || defined(__aarch64__))
+  #if defined(__arm__) && defined(HWCAP2_AES)
+    return !!(getauxval(AT_HWCAP2) & HWCAP2_AES);
+  #elif defined(__aarch64__)
+    return !!(getauxval(AT_HWCAP) & HWCAP_AES);
+  #else
+    return false;
+  #endif
+#elif __has_builtin(__builtin_cpu_supports) && (defined(__i386__) || defined(__x86_64__))
+  return __builtin_cpu_supports("aes");
+#elif defined(__BUILTIN_CPU_SUPPORTS__) && defined(__powerpc__)
+  return __builtin_cpu_supports("vcrypto");
+#elif defined(__riscv)
+  // TODO: Implement detection of RISC-V vector crypto extension when possible.
+  // At the time of writing, no RISC-V hardware has it, so hardcode it off.
+  return false;
+#elif __SIZEOF_SIZE_T__ == 4
+  #warning Unknown 32-bit platform. Assuming AES is slow on this CPU.
+  return false;
+#else
+  #warning Unknown 64-bit platform. Assuming AES is fast on this CPU.
+  return true;
+#endif
 }
\ No newline at end of file
diff --git a/src/util.h b/src/util.h
index adad8de..cb7bec1 100644
--- a/src/util.h
+++ b/src/util.h
@@ -23,3 +23,4 @@
 int write_bool(char *path, bool val);
 int read_file(char *path, char *output, int output_len);
 bool ensure_buf_size(void **buf, size_t *buf_size, size_t required_size);
+bool has_fast_aes(void);