diff --git a/storage/mozStorageConnection.cpp b/storage/mozStorageConnection.cpp
index a289eee7bc6..1268f31cd90 100644
--- a/storage/mozStorageConnection.cpp
+++ b/storage/mozStorageConnection.cpp
@@ -1322,10 +1322,11 @@ nsresult Connection::initialize(nsIFileURL* aFileURL) {
         hasKey = true;
       }
     }
-    // hasKey now decides whether we open through obfsvfs (see the VFS
-    // selection below); keep mDatabaseEncrypted and the page size in step.
-    SetDatabaseEncrypted(hasKey);
   }
+  // hasKey decides whether we open through obfsvfs (see the VFS selection
+  // below), whether the key came from the caller's URL or from the encryption
+  // policy; keep mDatabaseEncrypted and the page size in step.
+  SetDatabaseEncrypted(hasKey);
 
   // Conservative fail-closed: a database the encryption policy says must be
   // encrypted opens through obfsvfs with its key, or not at all -- it must
@@ -1416,6 +1417,22 @@ nsresult Connection::initializeInternal() {
     return convertResultCode(srv);
   }
 
+  // obfsvfs only encrypts the main database, rollback journal and WAL. SQLite
+  // otherwise spills statement subjournals, sorter runs and temp tables to
+  // plaintext files on builds without an in-memory SQLITE_TEMP_STORE default,
+  // so keep all temporary storage in memory for encrypted databases. The
+  // condition mirrors the SQLITE_TEMP_STORE block in
+  // third_party/sqlite3/src/moz.build.
+#if !defined(ANDROID) && !defined(HAVE_64BIT_BUILD)
+  if (mDatabaseEncrypted) {
+    srv = executeSql(mDBConn,
+                     MOZ_STORAGE_UNIQUIFY_QUERY_STR "PRAGMA temp_store = 2;");
+    if (srv != SQLITE_OK) {
+      return convertResultCode(srv);
+    }
+  }
+#endif
+
   // Register our built-in SQL functions.
   srv = registerFunctions(mDBConn);
   if (srv != SQLITE_OK) {
diff --git a/third_party/sqlite3/src/moz.build b/third_party/sqlite3/src/moz.build
index da931832e0c..d00222bf3ab 100644
--- a/third_party/sqlite3/src/moz.build
+++ b/third_party/sqlite3/src/moz.build
@@ -92,6 +92,9 @@ DEFINES['SQLITE_OMIT_BUILTIN_TEST'] = True
 # Try to use a MEMORY temp store when possible. That allows for better
 # performance and doesn't suffer from a full separate tmp partition.
 # Exclude 32bit platforms due to address space fragmentation issues.
+# Connection::initializeInternal in storage/mozStorageConnection.cpp assumes
+# these values when deciding whether encrypted databases need to set
+# PRAGMA temp_store themselves; keep the two in sync.
 if CONFIG['OS_TARGET'] == 'Android':
     # On Android there's no tmp partition, so always use a MEMORY temp store.
     DEFINES['SQLITE_TEMP_STORE'] = 3