diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 5ec4e577b8..6452d027a9 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15269,6 +15269,7 @@ dependencies = [
  "pg_escape",
  "pin-project",
  "postgres-native-tls 0.5.0",
+ "postgres-native-tls 0.5.1",
  "prometheus",
  "quick_cache",
  "rand 0.9.0",
diff --git a/backend/windmill-api/Cargo.toml b/backend/windmill-api/Cargo.toml
index 34cb7adfe9..7b8888b38e 100644
--- a/backend/windmill-api/Cargo.toml
+++ b/backend/windmill-api/Cargo.toml
@@ -94,6 +94,7 @@ tempfile.workspace = true
 tokio-util.workspace = true
 tokio-tar.workspace = true
 tokio-postgres.workspace = true
+postgres-native-tls.workspace = true
 hmac.workspace = true
 cookie.workspace = true
 sha2.workspace = true
diff --git a/backend/windmill-api/src/settings.rs b/backend/windmill-api/src/settings.rs
index de00d3cbe6..62cb87d391 100644
--- a/backend/windmill-api/src/settings.rs
+++ b/backend/windmill-api/src/settings.rs
@@ -701,23 +701,49 @@ async fn setup_ducklake_catalog_db_inner(
         sslmode = ssl_mode
     );
 
-    let (client, connection) = tokio::time::timeout(
-        std::time::Duration::from_secs(20),
-        tokio_postgres::connect(&conn_str, tokio_postgres::NoTls),
-    )
-    .await
-    .map_err(|e| error::Error::ExecutionErr(format!("timeout: {}", e.to_string())))?
-    .map_err(|e| error::Error::ExecutionErr(format!("error: {}", e.to_string())))?;
-    let join_handle = tokio::spawn(async move { connection.await });
+    let (client, join_handle) = if ssl_mode == "require" {
+        use native_tls::TlsConnector;
+        use postgres_native_tls::MakeTlsConnector;
+
+        let mut connector = TlsConnector::builder();
+        connector.danger_accept_invalid_certs(true);
+        connector.danger_accept_invalid_hostnames(true);
+
+        let (client, connection) = tokio::time::timeout(
+            std::time::Duration::from_secs(20),
+            tokio_postgres::connect(
+                &conn_str,
+                MakeTlsConnector::new(connector.build().map_err(to_anyhow)?),
+            ),
+        )
+        .await
+        .map_err(|e| error::Error::ExecutionErr(format!("timeout: {}", e.to_string())))?
+        .map_err(|e| error::Error::ExecutionErr(format!("error: {}", e.to_string())))?;
+
+        let join_handle = tokio::spawn(async move { connection.await });
+        (client, join_handle)
+    } else {
+        let (client, connection) = tokio::time::timeout(
+            std::time::Duration::from_secs(20),
+            tokio_postgres::connect(&conn_str, tokio_postgres::NoTls),
+        )
+        .await
+        .map_err(|e| error::Error::ExecutionErr(format!("timeout: {}", e.to_string())))?
+        .map_err(|e| error::Error::ExecutionErr(format!("error: {}", e.to_string())))?;
+
+        let join_handle = tokio::spawn(async move { connection.await });
+        (client, join_handle)
+    };
+
     logs.db_connect = "OK".to_string();
 
     client
         .batch_execute(&format!(
             "GRANT CONNECT ON DATABASE \"{dbname}\" TO ducklake_user;
-            GRANT USAGE ON SCHEMA public TO ducklake_user;
-            GRANT CREATE ON SCHEMA public TO ducklake_user;
-            ALTER DEFAULT PRIVILEGES IN SCHEMA public 
-                GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ducklake_user;"
+             GRANT USAGE ON SCHEMA public TO ducklake_user;
+             GRANT CREATE ON SCHEMA public TO ducklake_user;
+             ALTER DEFAULT PRIVILEGES IN SCHEMA public
+                 GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ducklake_user;"
         ))
         .await
         .map_err(|e| {