partEncryptionKey := objectEncryptionKey.DerivePartKey(uint32(partID))
			in := io.Reader(hashReader)
			if size > encryptBufferThreshold {
				// The encryption reads in blocks of 64KB.
				// We add a buffer on bigger files to reduce the number of syscalls upstream.
				in = bufio.NewReaderSize(hashReader, encryptBufferSize)
			}
			reader, err = sio.EncryptReader(in, sio.Config{Key: partEncryptionKey[:], CipherSuites: fips.DARECiphers()})