diff --git a/internal/util/crypto.go b/internal/util/crypto.go
index 07780fdb1..c9e64352b 100644
--- a/internal/util/crypto.go
+++ b/internal/util/crypto.go
@@ -261,6 +261,17 @@ func OpenEncryptedVolume(ctx context.Context, devicePath, mapperFile, passphrase
 	return err
 }
 
+// ResizeEncryptedVolume resizes encrypted volume so that it can be used by the client.
+func ResizeEncryptedVolume(ctx context.Context, mapperFile string) error {
+	DebugLog(ctx, "Resizing LUKS device %s", mapperFile)
+	_, stderr, err := LuksResize(mapperFile)
+	if err != nil {
+		ErrorLog(ctx, "failed to resize LUKS device %s: %s", mapperFile, stderr)
+	}
+
+	return err
+}
+
 // CloseEncryptedVolume closes encrypted volume so it can be detached.
 func CloseEncryptedVolume(ctx context.Context, mapperFile string) error {
 	DebugLog(ctx, "Closing LUKS device %s", mapperFile)
diff --git a/internal/util/cryptsetup.go b/internal/util/cryptsetup.go
index 22bc30e72..dbdb45102 100644
--- a/internal/util/cryptsetup.go
+++ b/internal/util/cryptsetup.go
@@ -43,6 +43,11 @@ func LuksOpen(devicePath, mapperFile, passphrase string) (stdout, stderr []byte,
 	return execCryptsetupCommand(&passphrase, "luksOpen", devicePath, mapperFile, "-d", "/dev/stdin")
 }
 
+// LuksResize resizes LUKS encrypted partition.
+func LuksResize(mapperFile string) (stdout, stderr []byte, err error) {
+	return execCryptsetupCommand(nil, "resize", mapperFile)
+}
+
 // LuksClose removes existing mapping.
 func LuksClose(mapperFile string) (stdout, stderr []byte, err error) {
 	return execCryptsetupCommand(nil, "luksClose", mapperFile)