diff --git a/config/database.yml b/config/database.yml
index 212d9cdd..ab0494b1 100644
--- a/config/database.yml
+++ b/config/database.yml
@@ -11,6 +11,10 @@ default: &default
   connect_timeout: 5
   variables:
     statement_timeout: 5000 # ms
+  sslmode: <%= ENV.fetch('DATABASE_SSL_MODE', ENV.fetch('DATABASE_SSL_CA', nil) ? 'verify-full' : 'disable') %>
+  sslrootcert: <%= ENV['DATABASE_SSL_CA'] %>
+  sslcert: <%= ENV['DATABASE_SSL_CERT'] %>
+  sslkey: <%= ENV['DATABASE_SSL_KEY'] %>
 
 development:
   <<: *default