diff --git a/src/Filo/Core/FiloReader.cs b/src/Filo/Core/FiloReader.cs
index 75caaf1..5f1c66c 100644
--- a/src/Filo/Core/FiloReader.cs
+++ b/src/Filo/Core/FiloReader.cs
@@ -192,8 +192,8 @@ public async IAsyncEnumerable<byte[]> StreamFileAsync(string fileName, byte[]? k
         if (!_fileMap.TryGetValue(fileName, out var entry))
             throw new FileNotFoundException($"File '{fileName}' not found in container.");
 
-        if (Header.Encryption == "AES256" && key == null)
-            throw new InvalidOperationException("This container is encrypted. Provide a key.");
+        if (Header.Encryption == "AES256" && Header.EncryptionMode != "AES-CBC")
+            throw new InvalidDataException("Unsupported encryption mode.");
 
         if (entry.Chunks.Count == 0)
             yield break;
diff --git a/src/Filo/Core/FiloWriter.cs b/src/Filo/Core/FiloWriter.cs
index db54a26..8b46172 100644
--- a/src/Filo/Core/FiloWriter.cs
+++ b/src/Filo/Core/FiloWriter.cs
@@ -111,6 +111,7 @@ public async Task WriteAsync()
                 FileCount = _files.Count,
                 Compression = "none",
                 Encryption = _encrypt ? "AES256" : "none",
+                EncryptionMode = _encrypt ? "AES-CBC" : null,
                 Kdf = !string.IsNullOrWhiteSpace(_password) ? "PBKDF2" : null,
                 Salt = !string.IsNullOrWhiteSpace(_password) ? Convert.ToBase64String(_salt!) : null,
                 PasswordCheck = _encrypt ? SHA256.HashData(_key!) : null,
diff --git a/src/Filo/Models/FiloHeader.cs b/src/Filo/Models/FiloHeader.cs
index cea7efe..8a16eaf 100644
--- a/src/Filo/Models/FiloHeader.cs
+++ b/src/Filo/Models/FiloHeader.cs
@@ -14,6 +14,8 @@ public class FiloHeader
 
     public string Encryption { get; set; } = "none";
 
+    public string? EncryptionMode { get; set; } = "AES-CBC";
+
     public string? Kdf { get; set; } // v1.1
 
     public string? Salt { get; set; } // v1.1