diff --git a/bip-0138.md b/bip-0138.md
index 90ae803e..d5b2ab5a 100644
--- a/bip-0138.md
+++ b/bip-0138.md
@@ -196,7 +196,9 @@ and integrity.[^chacha-default]
     hardware acceleration, making it suitable for hardware wallets and embedded devices.
 
 * let $nonce$ = random(96 bits)
-* let $ciphertext$ = encrypt($payload$, $secret$, $nonce$)
+* let $ciphertext$ = encrypt($payload$, $secret$, $nonce$, $aad$)
+
+The additional authenticated data ($aad$) is empty.
 
 The $nonce$ MUST NOT be all zero. If the random source yields an all-zero nonce,
 the encoder MUST generate a new one.
@@ -210,7 +212,7 @@ computes:
 * for each `individual_secret_i` generate `reconstructed_secret_i` =
 `individual_secret_i` ⊕ `si`
 * for each `reconstructed_secret_i` process $payload$ =
-decrypt($ciphertext$, $secret$, $nonce$)
+decrypt($ciphertext$, $secret$, $nonce$, $aad$)
 
 Decryption will succeed if and only if **p** was one of the keys in the
 descriptor/wallet policy.