diff --git a/cmd/managed-bootstrap/main.go b/cmd/managed-bootstrap/main.go
index 4ab7731..f8ae9d7 100644
--- a/cmd/managed-bootstrap/main.go
+++ b/cmd/managed-bootstrap/main.go
@@ -33,6 +33,15 @@ func main() {
 		os.Exit(2)
 	}
 	o.Connection = os.Getenv("CODEFLY_POSTGRES_MIGRATION_CONNECTION")
+	// Delivered as configuration beside the connection they describe, never as
+	// flags: a Job's command line is readable by anything in its pod, and these
+	// two are the deployment's statement about where this database is. Neither is
+	// a secret — an issuer names who mints the credential, and a certificate
+	// authority is public — but a credential minted FROM the issuer is, so it
+	// never appears here at all. Absent means the password-authenticated
+	// behaviour every existing deployment has.
+	o.ExternalIdentity = os.Getenv("CODEFLY_POSTGRES_EXTERNAL_IDENTITY")
+	o.ServerTrustAnchorPEM = os.Getenv("CODEFLY_POSTGRES_SERVER_AUTHORITY_PEM")
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
 	result, err := bootstrap.Run(ctx, o)
diff --git a/go.mod b/go.mod
index a81a129..8f3e51b 100644
--- a/go.mod
+++ b/go.mod
@@ -5,7 +5,7 @@ go 1.27.3
 require (
 	github.com/codefly-dev/core v0.19.8
 	github.com/codefly-dev/gortk v0.2.0
-	github.com/codefly-dev/service-postgres/libs/go v0.0.0-20260915032422-272301033aed
+	github.com/codefly-dev/service-postgres/libs/go v0.0.0-20261029025008-7fd6614ea9b6
 	github.com/gofrs/flock v0.13.1
 	github.com/golang-migrate/migrate/v4 v4.19.1
 	github.com/jackc/pgx/v5 v5.10.0
@@ -20,6 +20,7 @@ require (
 	buf.build/go/protovalidate v1.4.0 // indirect
 	cel.dev/cel-go v0.32.0 // indirect
 	cel.dev/expr v0.25.3 // indirect
+	cloud.google.com/go/compute/metadata v0.10.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
@@ -116,6 +117,7 @@ require (
 	golang.org/x/crypto v0.57.0 // indirect
 	golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
 	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/oauth2 v0.37.0 // indirect
 	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 	golang.org/x/term v0.46.0 // indirect
diff --git a/go.sum b/go.sum
index 9217176..aa7a41e 100644
--- a/go.sum
+++ b/go.sum
@@ -6,6 +6,8 @@ cel.dev/cel-go v0.32.0 h1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=
 cel.dev/cel-go v0.32.0/go.mod h1:DnVip7tpJSsgZymwfT+m1tnEVy3ivAjSMXPx12YrMkU=
 cel.dev/expr v0.25.3 h1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=
 cel.dev/expr v0.25.3/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+cloud.google.com/go/compute/metadata v0.10.0 h1:pyKMUQSwchgkIBBJGdILqQbs/BNJXqwSA7Ej6LAvvtY=
+cloud.google.com/go/compute/metadata v0.10.0/go.mod h1:rGFHRrIif570kSibjFTMbt6/4/tzgJWFGI/HVol4GIk=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0 h1:4gRPBpN1f6xt88yi4WR26m7XaD9OlWtVT6bWPdGUIok=
@@ -54,8 +56,8 @@ github.com/codefly-dev/core v0.19.8 h1:7ZFXXo51P4H0r22QUbTPzs1j9d6iyftvoeqPGKDFA
 github.com/codefly-dev/core v0.19.8/go.mod h1:NB7x1UZ01rYTfEZEl4vUFD1A+fgOXhsWbgA3M8x4ThA=
 github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ=
 github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg=
-github.com/codefly-dev/service-postgres/libs/go v0.0.0-20260915032422-272301033aed h1:P4H/FvViECu25UB7OEyCgyyDVsj6/Ql5rRPKCtcUklA=
-github.com/codefly-dev/service-postgres/libs/go v0.0.0-20260915032422-272301033aed/go.mod h1:5mwz8oM8INcukJLc6C84zdRnmDQ/gkMNI8GxWMwgk+8=
+github.com/codefly-dev/service-postgres/libs/go v0.0.0-20261029025008-7fd6614ea9b6 h1:siiBUk1ChXxpCFt+KGqAOaa+y+x3GDniLyoJ2/5azIM=
+github.com/codefly-dev/service-postgres/libs/go v0.0.0-20261029025008-7fd6614ea9b6/go.mod h1:uZ62/aYNXE4EykSKJg3CRggwxPVpb3YdZIVt/NPj1R0=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
@@ -314,6 +316,8 @@ golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
 golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
 golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
+golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
 golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=