diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 836da4c13c..38aa2aba71 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15452,6 +15452,7 @@ dependencies = [
  "tracing-opentelemetry",
  "tracing-subscriber",
  "url",
+ "urlencoding",
  "uuid",
  "windmill-macros",
  "windmill-parser",
diff --git a/backend/windmill-common/Cargo.toml b/backend/windmill-common/Cargo.toml
index 8317940079..674c48ffd3 100644
--- a/backend/windmill-common/Cargo.toml
+++ b/backend/windmill-common/Cargo.toml
@@ -86,6 +86,7 @@ openidconnect = { workspace = true, optional = true }
 strum.workspace = true
 strum_macros.workspace = true
 url.workspace = true
+urlencoding.workspace = true
 async-recursion.workspace = true
 
 semver.workspace = true
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index b91dcfaf95..ada171a230 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -341,7 +341,12 @@ pub fn parse_postgres_url(url: &str) -> Result<PostgresUrlComponents, Error> {
 
     let scheme = parsed_url.scheme().to_string();
     let username = parsed_url.username().to_string();
+    let username = urlencoding::decode(&username).map_err(to_anyhow)?.to_string();
     let password = parsed_url.password().map(|p| p.to_string());
+    let password = match password {
+        Some(p) => Some(urlencoding::decode(&p).map_err(to_anyhow)?.to_string()),
+        None => None,
+    };
     let host = parsed_url
         .host_str()
         .ok_or_else(|| Error::BadConfig("Missing host in PostgreSQL URL".to_string()))?
@@ -490,9 +495,7 @@ type Tag = String;
 pub use db::DB;
 
 use crate::{
-    auth::{PermsCache, FLOW_PERMS_CACHE, HASH_PERMS_CACHE},
-    db::{AuthedRef, UserDbWithAuthed},
-    scripts::ScriptHash,
+    auth::{FLOW_PERMS_CACHE, HASH_PERMS_CACHE, PermsCache}, db::{AuthedRef, UserDbWithAuthed}, error::to_anyhow, scripts::ScriptHash
 };
 
 #[derive(Clone)]
diff --git a/backend/windmill-worker/src/pg_executor.rs b/backend/windmill-worker/src/pg_executor.rs
index e240b5d87b..15cc6ccf30 100644
--- a/backend/windmill-worker/src/pg_executor.rs
+++ b/backend/windmill-worker/src/pg_executor.rs
@@ -241,7 +241,7 @@ pub async fn do_postgresql(
         "postgres://{user}:{password}@{host}:{port}/{dbname}?sslmode={sslmode}",
         user = encode(&database.user.unwrap_or("postgres".to_string())),
         password = encode(&database.password.unwrap_or("".to_string())),
-        host = encode(&database.host),
+        host = database.host,
         port = database.port.unwrap_or(5432),
         dbname = database.dbname,
         sslmode = sslmode
diff --git a/frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte b/frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte
index 1910bca0e5..c4ecbf8855 100644
--- a/frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte
@@ -295,7 +295,7 @@
 								<Popover
 									class="absolute right-1.5"
 									enableFlyTransition
-									contentClasses="py-5 px-6 w-[34rem] bg-surface-secondary -translate-y-2"
+									contentClasses="py-5 px-6 w-[34rem] bg-surface-secondary -translate-y-2 overflow-y-auto"
 									closeOnOtherPopoverOpen
 									closeOnOutsideClick
 									bind:this={instanceCatalogPopover}
@@ -503,7 +503,7 @@
 					await instanceCatalogStatuses.refresh()
 					if (result.success) {
 						if (!wasAlreadySuccessful) sendUserToast('Setup successful')
-						else sendUserToast('Everything OK')
+						else sendUserToast('Check successful')
 					} else {
 						sendUserToast(result.error ?? 'An error occured', true)
 					}