diff --git a/cloud/infra/terraform/relay-gce-cells.tf b/cloud/infra/terraform/relay-gce-cells.tf
index d6b7f3351f9..a4505ba2e37 100644
--- a/cloud/infra/terraform/relay-gce-cells.tf
+++ b/cloud/infra/terraform/relay-gce-cells.tf
@@ -242,6 +242,7 @@ resource "google_compute_instance_template" "relay_gce_cell" {
     artifact_registry_host          = "${var.region}-docker.pkg.dev"
     relay_image                     = each.value.image
     cloud_sql_proxy_image           = var.relay_gce_cloud_sql_proxy_image
+    cloud_sql_private_ip            = var.relay_cloud_sql_private_ip
     # Keep cell-only plans independent from unrelated database configuration drift.
     cloud_sql_connection_name = local.relay_database_connection_name
   })
diff --git a/cloud/infra/terraform/relay-gce-startup.sh.tftpl b/cloud/infra/terraform/relay-gce-startup.sh.tftpl
index f593d94e9e5..a77466f2169 100644
--- a/cloud/infra/terraform/relay-gce-startup.sh.tftpl
+++ b/cloud/infra/terraform/relay-gce-startup.sh.tftpl
@@ -109,6 +109,9 @@ docker run --detach \
   --user 0:0 \
   --volume "$${cloudsql_dir}:/cloudsql" \
   '${cloud_sql_proxy_image}' \
+%{ if cloud_sql_private_ip ~}
+  --private-ip \
+%{ endif ~}
   --unix-socket=/cloudsql \
   '${cloud_sql_connection_name}'
 
diff --git a/cloud/infra/terraform/variables.tf b/cloud/infra/terraform/variables.tf
index 68f6c555bd3..91f67e8ebe0 100644
--- a/cloud/infra/terraform/variables.tf
+++ b/cloud/infra/terraform/variables.tf
@@ -468,6 +468,12 @@ variable "relay_gce_fenced_cells" {
   default     = []
 }
 
+variable "relay_cloud_sql_private_ip" {
+  type        = bool
+  description = "Dial Cloud SQL over its private IP inside this VPC instead of its public IP through Cloud NAT. Requires the foundation root's private services access peering to be applied first; a cell that cannot reach the private IP never becomes ready."
+  default     = false
+}
+
 variable "relay_gce_cloud_sql_proxy_image" {
   type        = string
   description = "Digest-pinned Cloud SQL Auth Proxy image used by private relay workers."