diff --git a/deploy/deploy.schema.json b/deploy/deploy.schema.json
index a37e6d35..645c83ec 100644
--- a/deploy/deploy.schema.json
+++ b/deploy/deploy.schema.json
@@ -419,6 +419,7 @@
       "type": "object",
       "properties": {
         "image": { "type": "string", "minLength": 1 },
+        "sslMode": { "type": "string", "enum": ["disable", "require"] },
         "poolMax": { "type": "integer", "minimum": 1 },
         "connectionTimeoutMs": { "type": "integer", "minimum": 1 },
         "queryTimeoutMs": { "type": "integer", "minimum": 1 },
diff --git a/deploy/deploy.yaml b/deploy/deploy.yaml
index c0f5a260..b3be688c 100644
--- a/deploy/deploy.yaml
+++ b/deploy/deploy.yaml
@@ -387,6 +387,7 @@ lanes:
     runtimeStore:
       postgres:
         image: postgres:16-alpine
+        sslMode: require
         poolMax: 4
         connectionTimeoutMs: 5000
         queryTimeoutMs: 3000
diff --git a/scripts/gitops-render.mjs b/scripts/gitops-render.mjs
index db1d585e..a1fd3ef1 100644
--- a/scripts/gitops-render.mjs
+++ b/scripts/gitops-render.mjs
@@ -1182,6 +1182,7 @@ function runtimeStoreEnvForProfile(deploy, profile, serviceId) {
   const postgres = runtimeLaneConfig(deploy, profile)?.runtimeStore?.postgres;
   if (!postgres || typeof postgres !== "object" || Array.isArray(postgres)) return {};
   const env = {};
+  if (postgres.sslMode === "disable" || postgres.sslMode === "require") env.HWLAB_CLOUD_DB_SSL_MODE = postgres.sslMode;
   if (Number.isInteger(postgres.poolMax)) env.HWLAB_CLOUD_DB_POOL_MAX = String(postgres.poolMax);
   if (Number.isInteger(postgres.connectionTimeoutMs)) {
     env.HWLAB_CLOUD_DB_PROBE_TIMEOUT_MS = String(postgres.connectionTimeoutMs);
diff --git a/scripts/gitops-render.test.ts b/scripts/gitops-render.test.ts
index 2723b482..adcd8d7e 100644
--- a/scripts/gitops-render.test.ts
+++ b/scripts/gitops-render.test.ts
@@ -637,6 +637,7 @@ test("v03 render keeps node identity as data instead of generated structure", as
     assert.equal(cloudApiEnv.get("HWLAB_BOOT_COMMIT"), sourceRevision);
     assert.equal(cloudApiEnv.get("HWLAB_GITOPS_SOURCE_COMMIT"), sourceRevision);
     assert.equal(cloudApiEnv.get("HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT"), sourceRevision);
+    assert.equal(cloudApiEnv.get("HWLAB_CLOUD_DB_SSL_MODE"), "require");
     assert.match(cloudApiEnv.get("HWLAB_ENVIRONMENT_IMAGE") ?? "", /hwlab-cloud-api-env:env-stale/u);
     assert.deepEqual(cloudApiEnvEntries.get("HWLAB_SECRET_PLANE_SMOKE")?.valueFrom?.secretKeyRef, { name: "hwlab-secret-plane-smoke", key: "password", optional: true });
     assert.ok((cloudApi?.spec?.template?.spec?.volumes ?? []).some((volume) => volume.name === "hwpod-preinstalled-specs" && volume.configMap?.name === "hwlab-v03-hwpod-preinstalled-specs"));