Secure boot v2 and Flash Encryption on production

[nonagon]

We want to have secure boot v2 and flash encryption enabled for our products based on a custom esp32 s2 pcb, we read the IDF SDK manual but it's not clear how to have it enabled together without bricking the device.
We flash the product one by one, having a key for secure boot and an elf signed with that key what the exact sequence of commands to flash a virgin device with secure boot and flash encryption in release mode enabled?
Thanks