diff --git a/transcoder/.env.example b/transcoder/.env.example
index b8772e540..d285cef6f 100644
--- a/transcoder/.env.example
+++ b/transcoder/.env.example
@@ -26,6 +26,8 @@ POSTGRES_PASSWORD=
 POSTGRES_DB=
 POSTGRES_SERVER=
 POSTGRES_PORT=5432
+# can also be "require" ("prefer" is not supported)
+POSTGRES_SSLMODE="disable"
 # Default is gocoder, you can specify "disabled" to use the default search_path of the user.
 #  If this is not "disabled", the schema will be created (if it does not exists) and
 #  the search_path of the user will be ignored (only the schema specified will be used).
diff --git a/transcoder/src/metadata.go b/transcoder/src/metadata.go
index 155c68639..4f191f243 100644
--- a/transcoder/src/metadata.go
+++ b/transcoder/src/metadata.go
@@ -24,12 +24,13 @@ type MetadataService struct {
 
 func NewMetadataService() (*MetadataService, error) {
 	con := fmt.Sprintf(
-		"postgresql://%v:%v@%v:%v/%v?application_name=gocoder&sslmode=disable",
+		"postgresql://%v:%v@%v:%v/%v?application_name=gocoder&sslmode=%s",
 		url.QueryEscape(os.Getenv("POSTGRES_USER")),
 		url.QueryEscape(os.Getenv("POSTGRES_PASSWORD")),
 		url.QueryEscape(os.Getenv("POSTGRES_SERVER")),
 		url.QueryEscape(os.Getenv("POSTGRES_PORT")),
 		url.QueryEscape(os.Getenv("POSTGRES_DB")),
+		url.QueryEscape(GetEnvOr("POSTGRES_SSLMODE", "disable")),
 	)
 	schema := GetEnvOr("POSTGRES_SCHEMA", "gocoder")
 	if schema != "disabled" {