diff --git a/src/helm/impress/values.yaml b/src/helm/impress/values.yaml
index e432772ab..5740f7fe6 100644
--- a/src/helm/impress/values.yaml
+++ b/src/helm/impress/values.yaml
@@ -1084,6 +1084,7 @@ yhub:
   ## @param yhub.envVars Configure yhub container environment variables
   ## @extra yhub.envVars.REDIS Required, redis/valkey url holding the live document state (e.g. redis://valkey:6379/0)
   ## @extra yhub.envVars.POSTGRES Required, url of the yhub database, created by the init-db job (e.g. postgres://user:pass@postgres:5432/yhub)
+  ##   Append `?sslmode=require` (or `verify-full`) when the server only accepts TLS, which is the default of the Zalando/Spilo operator
   ## @extra yhub.envVars.REDIS_PREFIX Namespace of the redis keys, when the instance is shared (default: yhub)
   ## @extra yhub.envVars.COLLABORATION_BACKEND_BASE_URL Base url of the Docs backend, which yhub asks about users and document access rights
   ## @extra yhub.envVars.COLLABORATION_SERVER_ORIGIN Comma separated list of the origins allowed to open a websocket
diff --git a/src/yhub-server/README.md b/src/yhub-server/README.md
index 45074fcb5..68bef5354 100644
--- a/src/yhub-server/README.md
+++ b/src/yhub-server/README.md
@@ -556,6 +556,15 @@ the DDL is applied (`relation "yhub_ydoc_tombstones_v1" does not exist`, for
 instance). Nothing in this repository copies the schema, so an upgrade is
 `package.json` plus this script and nothing else.
 
+The connection is not encrypted unless the url asks for it. A server that only
+has `hostssl` rules in its `pg_hba.conf` — the default of the Zalando/Spilo
+operator — answers `pg_hba.conf rejects connection for host ..., no
+encryption`: append `?sslmode=require` to `POSTGRES`
+(`postgres://user:pass@host:5432/yhub?sslmode=require`), or
+`?sslmode=verify-full` when the certificate of the server is signed by an
+authority Node trusts (`NODE_EXTRA_CA_CERTS`). The server, the worker and
+`init-db` all read the same url, so the parameter is set once.
+
 From the repository root, `make migrate-yhub` runs it against the dev stack —
 the counterpart of `make migrate` for the Django database. `make bootstrap`
 already includes it, so a fresh checkout needs nothing extra; an upgrade is