diff --git a/internal/bsr/bsr.go b/internal/bsr/bsr.go
index 52322eb96..a117fc737 100644
--- a/internal/bsr/bsr.go
+++ b/internal/bsr/bsr.go
@@ -24,7 +24,8 @@ const (
 
 // SessionMeta contains metadata about a session in a BSR.
 type SessionMeta struct {
-	Id string
+	Id       string
+	Protocol Protocol
 }
 
 // Session is the top level container in a bsr that contains the files for
@@ -66,6 +67,10 @@ func NewSession(ctx context.Context, meta *SessionMeta, f storage.FS, keys *kms.
 	if err != nil {
 		return nil, err
 	}
+	_, err = nc.WriteMeta(ctx, "protocol", meta.Protocol.ToText())
+	if err != nil {
+		return nil, err
+	}
 	return &Session{
 		container:   nc,
 		multiplexed: opts.withSupportsMultiplex,
diff --git a/internal/bsr/bsr_test.go b/internal/bsr/bsr_test.go
index 36a3526cb..bd571f392 100644
--- a/internal/bsr/bsr_test.go
+++ b/internal/bsr/bsr_test.go
@@ -10,6 +10,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"regexp"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -17,6 +18,7 @@ import (
 	"github.com/hashicorp/boundary/internal/bsr"
 	"github.com/hashicorp/boundary/internal/bsr/internal/fstest"
 	"github.com/hashicorp/boundary/internal/bsr/kms"
+	"github.com/hashicorp/boundary/internal/bsr/ssh"
 	"github.com/hashicorp/boundary/internal/storage"
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	"github.com/stretchr/testify/assert"
@@ -34,7 +36,9 @@ func assertContainer(ctx context.Context, t *testing.T, path, state string, typ
 	require.NoError(t, err, "unable to find test data file")
 	meta, ok := fs.Files[string(typ)+".meta"]
 	require.True(t, ok, "container is missing meta file")
-	assert.Equal(t, string(wantMeta), meta.Buf.String())
+	wantChecksumsRegex, err := regexp.Compile(string(wantMeta))
+	require.NoError(t, err)
+	assert.True(t, wantChecksumsRegex.MatchString(meta.Buf.String()))
 
 	// summary
 	wantSummary, err := os.ReadFile(filepath.Join(td, string(typ)+".summary"))
@@ -188,7 +192,7 @@ func TestBsr(t *testing.T) {
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			s, err := bsr.NewSession(ctx, &bsr.SessionMeta{Id: tc.id}, tc.c, tc.keys, tc.opts...)
+			s, err := bsr.NewSession(ctx, &bsr.SessionMeta{Id: tc.id, Protocol: ssh.Protocol}, tc.c, tc.keys, tc.opts...)
 			require.NoError(t, err)
 			require.NotNil(t, s)
 
diff --git a/internal/bsr/protocol.go b/internal/bsr/protocol.go
index e4ad1d895..6711931fd 100644
--- a/internal/bsr/protocol.go
+++ b/internal/bsr/protocol.go
@@ -3,6 +3,8 @@
 
 package bsr
 
+import "regexp"
+
 // Protocol identifies the protocol of the data captured in a chunk.
 type Protocol string
 
@@ -10,3 +12,10 @@ type Protocol string
 func ValidProtocol(p Protocol) bool {
 	return len(p) <= protocolSize
 }
+
+// ToText converts a protocol to a text-safe string
+func (p Protocol) ToText() string {
+	re := regexp.MustCompile("[[:^ascii:]]")
+	t := re.ReplaceAllLiteralString(string(p), "")
+	return t
+}
diff --git a/internal/bsr/protocol_test.go b/internal/bsr/protocol_test.go
index e72886de1..b1c18f6c8 100644
--- a/internal/bsr/protocol_test.go
+++ b/internal/bsr/protocol_test.go
@@ -35,3 +35,39 @@ func TestValidProtocol(t *testing.T) {
 		})
 	}
 }
+
+func TestToText(t *testing.T) {
+	cases := []struct {
+		name string
+		in   bsr.Protocol
+		want string
+	}{
+		{
+			"all ascii",
+			bsr.Protocol("BOOM"),
+			"BOOM",
+		},
+		{
+			"not all ascii",
+			bsr.Protocol("SSH\x87"),
+			"SSH",
+		},
+		{
+			"mostly not ascii",
+			bsr.Protocol("S\x89\x99\x87"),
+			"S",
+		},
+		{
+			"no ascii",
+			bsr.Protocol("\x95\x89\x99\x87"),
+			"",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := tc.in.ToText()
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
diff --git a/internal/bsr/testdata/TestBsr/session_multiplexed/closed/SHA256SUM b/internal/bsr/testdata/TestBsr/session_multiplexed/closed/SHA256SUM
index 3701a0d48..2f6342a76 100644
--- a/internal/bsr/testdata/TestBsr/session_multiplexed/closed/SHA256SUM
+++ b/internal/bsr/testdata/TestBsr/session_multiplexed/closed/SHA256SUM
@@ -1,2 +1,2 @@
-ff2a532f46f3e2202e69b3aab760da95c290adf33a9a4b1c4a7e17e0a2671421  session.meta
+a7b7dc4a1c6032980f84d22afb71d59ccdf498db37f2e855a83d8854bdc297db  session.meta
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  session.summary
diff --git a/internal/bsr/testdata/TestBsr/session_multiplexed/closed/session.meta b/internal/bsr/testdata/TestBsr/session_multiplexed/closed/session.meta
index cbab238cf..00d7f24e1 100644
--- a/internal/bsr/testdata/TestBsr/session_multiplexed/closed/session.meta
+++ b/internal/bsr/testdata/TestBsr/session_multiplexed/closed/session.meta
@@ -1,2 +1,3 @@
 id: session_123456789
+protocol: SSH
 connection: conn_1.connection
diff --git a/internal/bsr/testdata/TestBsr/session_multiplexed/opened/session.meta b/internal/bsr/testdata/TestBsr/session_multiplexed/opened/session.meta
index f02ca207c..160507841 100644
--- a/internal/bsr/testdata/TestBsr/session_multiplexed/opened/session.meta
+++ b/internal/bsr/testdata/TestBsr/session_multiplexed/opened/session.meta
@@ -1 +1,2 @@
 id: session_123456789
+protocol: SSH
diff --git a/internal/bsr/testdata/TestBsr/session_not_multiplexed/closed/SHA256SUM b/internal/bsr/testdata/TestBsr/session_not_multiplexed/closed/SHA256SUM
index 3701a0d48..2f6342a76 100644
--- a/internal/bsr/testdata/TestBsr/session_not_multiplexed/closed/SHA256SUM
+++ b/internal/bsr/testdata/TestBsr/session_not_multiplexed/closed/SHA256SUM
@@ -1,2 +1,2 @@
-ff2a532f46f3e2202e69b3aab760da95c290adf33a9a4b1c4a7e17e0a2671421  session.meta
+a7b7dc4a1c6032980f84d22afb71d59ccdf498db37f2e855a83d8854bdc297db  session.meta
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  session.summary
diff --git a/internal/bsr/testdata/TestBsr/session_not_multiplexed/closed/session.meta b/internal/bsr/testdata/TestBsr/session_not_multiplexed/closed/session.meta
index cbab238cf..00d7f24e1 100644
--- a/internal/bsr/testdata/TestBsr/session_not_multiplexed/closed/session.meta
+++ b/internal/bsr/testdata/TestBsr/session_not_multiplexed/closed/session.meta
@@ -1,2 +1,3 @@
 id: session_123456789
+protocol: SSH
 connection: conn_1.connection
diff --git a/internal/bsr/testdata/TestBsr/session_not_multiplexed/opened/session.meta b/internal/bsr/testdata/TestBsr/session_not_multiplexed/opened/session.meta
index f02ca207c..160507841 100644
--- a/internal/bsr/testdata/TestBsr/session_not_multiplexed/opened/session.meta
+++ b/internal/bsr/testdata/TestBsr/session_not_multiplexed/opened/session.meta
@@ -1 +1,2 @@
 id: session_123456789
+protocol: SSH