diff --git a/helm/taskchampion-sync-server/templates/_helpers.tpl b/helm/taskchampion-sync-server/templates/_helpers.tpl
index 5473f22..1b04f91 100644
--- a/helm/taskchampion-sync-server/templates/_helpers.tpl
+++ b/helm/taskchampion-sync-server/templates/_helpers.tpl
@@ -82,8 +82,9 @@ app.kubernetes.io/instance: {{ .Release.Name }}
   {{- if ne $port "5432" -}}
     {{- $uri = printf "%s:%s" $uri $port -}}
   {{- end -}}
-  {{- if ne $database "taskchampion" -}}
-    {{- $uri = printf "%s/%s" $uri $database -}}
+  {{- $uri = printf "%s/%s" $uri $database -}}
+  {{- if .Values.postgres.sslMode -}}
+    {{- $uri = printf "%s?sslmode=%s" $uri .Values.postgres.sslMode -}}
   {{- end -}}
   {{- $uri -}}
 {{- end -}}
diff --git a/helm/taskchampion-sync-server/values.yaml b/helm/taskchampion-sync-server/values.yaml
index c7afab1..cae77a8 100644
--- a/helm/taskchampion-sync-server/values.yaml
+++ b/helm/taskchampion-sync-server/values.yaml
@@ -95,6 +95,10 @@ postgres:
   port: 5432
   username: user
   password: ""
+  # SSL mode for the PostgreSQL connection.
+  # Use 'disable' for internal cluster connections (no TLS).
+  # Options: disable, allow, prefer, require, verify-ca, verify-full
+  sslMode: disable
   initContainer:
     enabled: true
     image: postgres:15-alpine