diff --git a/backend/windmill-worker/src/mssql_executor.rs b/backend/windmill-worker/src/mssql_executor.rs
index 29c83cc876..238cba645e 100644
--- a/backend/windmill-worker/src/mssql_executor.rs
+++ b/backend/windmill-worker/src/mssql_executor.rs
@@ -32,6 +32,9 @@ struct MssqlDatabase {
     instance_name: Option<String>,
     #[serde(default, deserialize_with = "deserialize_aad_token")]
     aad_token: Option<AadToken>,
+    trust_cert: Option<bool>,
+    #[serde(deserialize_with = "empty_string_as_none")]
+    ca_cert: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -53,6 +56,7 @@ pub async fn do_mssql(
     canceled_by: &mut Option<CanceledBy>,
     worker_name: &str,
     occupancy_metrics: &mut OccupancyMetrics,
+    job_dir: &str,
 ) -> error::Result<Box<RawValue>> {
     let mssql_args = build_args_values(job, client, db).await?;
 
@@ -120,6 +124,23 @@ pub async fn do_mssql(
         ));
     }
 
+    // Handle certificate trust configuration
+    if database.trust_cert.unwrap_or(true) {
+        // If trust_cert is true, ignore ca_cert and trust any certificate
+        config.trust_cert();
+        tracing::info!("MSSQL: disabling certificate validation");
+    } else if let Some(ca_cert) = &database.ca_cert {
+        // Only use ca_cert if trust_cert is false
+        let cert_path = format!("{}/ca_cert.pem", job_dir);
+
+        std::fs::write(&cert_path, ca_cert)
+            .map_err(|e| Error::ExecutionErr(format!("Failed to write CA certificate: {}", e)))?;
+
+        // Use the CA certificate for trust
+        config.trust_cert_ca(cert_path);
+        tracing::info!("MSSQL: using provided CA certificate for trust");
+    }
+
     let tcp = if use_instance_name {
         TcpStream::connect_named(&config).await.map_err(to_anyhow)? // named instance
     } else {
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index cf9295c972..2347522778 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -1823,12 +1823,12 @@ async fn get_same_worker_job(
 ) -> windmill_common::error::Result<Option<PulledJob>> {
     sqlx::query_as::<_, PulledJob>(
         "WITH ping AS (
-                        UPDATE v2_job_runtime SET ping = NOW() WHERE id = $1 
+                        UPDATE v2_job_runtime SET ping = NOW() WHERE id = $1
                     ),
                     started_at AS (
                         UPDATE v2_job_queue SET started_at = NOW() WHERE id = $1
                     )
-                    SELECT 
+                    SELECT
                     v2_job_queue.workspace_id,
                     v2_job_queue.id,
                     v2_job.args,
@@ -1864,10 +1864,10 @@ async fn get_same_worker_job(
                     v2_job.raw_lock,
                     v2_job.raw_flow,
                     pj.runnable_path as parent_runnable_path,
-                    p.email as permissioned_as_email, p.username as permissioned_as_username, p.is_admin as permissioned_as_is_admin, 
+                    p.email as permissioned_as_email, p.username as permissioned_as_username, p.is_admin as permissioned_as_is_admin,
                     p.is_operator as permissioned_as_is_operator, p.groups as permissioned_as_groups, p.folders as permissioned_as_folders
-                    FROM v2_job_queue 
-                    INNER JOIN v2_job ON v2_job.id = v2_job_queue.id 
+                    FROM v2_job_queue
+                    INNER JOIN v2_job ON v2_job.id = v2_job_queue.id
                     LEFT JOIN v2_job_status ON v2_job_status.id = v2_job_queue.id
                     LEFT JOIN job_perms p ON p.job_id = v2_job.id
                     LEFT JOIN v2_job pj ON v2_job.parent_job = pj.id
@@ -2745,6 +2745,7 @@ async fn handle_code_execution_job(
                 canceled_by,
                 worker_name,
                 occupancy_metrics,
+                job_dir,
             )
             .await;
         }