@@ -2128,10 +2128,6 @@ const EnvironmentSchema = z
         "WEBHOOK_DELIVERY_STORAGE_DAYS must be a delivery retention class (3, 7, 30, 90, 180 or 365)"
       ),
 
-    // Ingest hot-path cache for the endpoint + resolved signing secret (keyed by opaqueId). 0 disables.
-    WEBHOOK_ENDPOINT_CACHE_TTL_MS: z.coerce.number().int().default(30_000),
-    WEBHOOK_ENDPOINT_CACHE_MAX_SIZE: z.coerce.number().int().default(10_000),
-
     WEBHOOK_INGRESS_ENABLED: z.string().default("1"),
 
     // Public origin for the webhook ingress URL shown to users / returned by the API. Defaults to the
 
@@ -7,7 +7,7 @@ import type { WebhookDeliverTaskErrorType, WebhookRedisOptions } from "@internal
 import { tryCatch } from "@trigger.dev/core/utils";
 import { resolve4 } from "node:dns/promises";
 import { z } from "zod";
-import { prisma, webhookPartitionPrisma, webhookPrisma } from "~/db.server";
+import { $replica, webhookPartitionPrisma, webhookPrisma, webhookReplica } from "~/db.server";
 import { env } from "~/env.server";
 import { findEnvironmentById } from "~/models/runtimeEnvironment.server";
 import { logger } from "~/services/logger.server";
@@ -89,10 +89,11 @@ export function webhookVerifyTokenKey(endpointId: string): string {
 function createWebhookEngine() {
   // The engine owns the webhook tables, so it runs on the webhook DB client. The signing-secret
   // store stays on the main client below (SecretStore is control-plane, not part of the split).
-  const secretStore = getSecretStore("DATABASE", { prismaClient: prisma });
+  const secretStore = getSecretStore("DATABASE", { prismaClient: $replica });
 
   const engine = new WebhookEngine({
     prisma: webhookPrisma,
+    replica: webhookReplica,
     partitionPrisma: webhookPartitionPrisma,
     logLevel: env.WEBHOOK_ENGINE_LOG_LEVEL,
     disabled: env.WEBHOOK_ENABLED !== "1",
@@ -121,10 +122,6 @@ function createWebhookEngine() {
       defaultTtlSeconds: env.WEBHOOK_FRONT_GATE_DEFAULT_TTL_SECONDS,
       maxTtlSeconds: env.WEBHOOK_FRONT_GATE_MAX_TTL_SECONDS,
     },
-    endpointCache: {
-      ttlMs: env.WEBHOOK_ENDPOINT_CACHE_TTL_MS,
-      maxSize: env.WEBHOOK_ENDPOINT_CACHE_MAX_SIZE,
-    },
     waiters: {
       limits: {
         perEnvironment: env.WEBHOOK_WAITER_MAX_PER_ENVIRONMENT,
 
@@ -80,7 +80,6 @@ containerTestWithIsolatedRedis(
         tenantConcurrency: async (environmentId) => (environmentId === "env_noisy" ? 2 : 4),
         pollIntervalMs: 20,
       },
-      endpointCache: { ttlMs: 0 },
       triggerTask,
       resolveSigningSecret: async (key) => (key === SECRET_KEY ? SECRET : undefined),
       logLevel: "error",
@@ -117,7 +116,6 @@ containerTestWithIsolatedRedis(
     const common = {
       prisma,
       redis: redisOptions,
-      endpointCache: { ttlMs: 0 },
       resolveSigningSecret: async (key: string) => (key === SECRET_KEY ? SECRET : undefined),
       logLevel: "error" as const,
     };
 
@@ -4,6 +4,7 @@ import { Logger } from "@trigger.dev/core/logger";
 import type {
   Prisma,
   WebhookDatabase,
+  WebhookReplicaDatabase,
   WebhookDelivery,
   WebhookDeliveryStatus,
   WebhookEndpoint,
@@ -37,7 +38,6 @@ import {
 import { isInfrastructureError, WebhookInfrastructureError } from "./errors.js";
 import { QueueMemoryGuard } from "./memoryGuard.js";
 import { ensurePartitions, listDatedPartitions, partitionsCoveredUntil } from "./partitions.js";
-import { type CachedEndpoint, TtlCache } from "./cache.js";
 import { evaluateFilter, parseFilter } from "./filter/index.js";
 import { verifyWithSecrets } from "./verification/index.js";
 import { sha256Hex } from "./verification/util.js";
@@ -122,6 +122,13 @@ type TargetOutcome =
 type TaskTarget = Extract<WebhookRoutingTarget, { type: "task" }>;
 type SessionTarget = Extract<WebhookRoutingTarget, { type: "session" }>;
 
+/** An ACTIVE endpoint with its signing secrets (current first) and parsed routing targets. */
+type ResolvedEndpoint = {
+  endpoint: WebhookEndpoint;
+  secrets: [string, ...string[]];
+  targets: ParsedRoutingTarget[];
+};
+
 /** The response contract declared on a verifier artifact, if any (bundles carry none). */
 function artifactResponseContract(artifact: WebhookVerifierArtifact) {
   return "response" in artifact ? artifact.response : undefined;
@@ -202,7 +209,6 @@ export class WebhookEngine {
   private deliveryExecutionDuration: Histogram;
   private deliveryExecutionFailureCounter: Counter;
   private ensurePartitionsCounter: Counter;
-  private endpointCacheCounter: Counter;
   private ingestCounter: Counter;
   private ingestRefusedCounter: Counter;
   private frontGateRequeuedCounter: Counter;
@@ -217,19 +223,17 @@ export class WebhookEngine {
   private partitionCoverageTimer?: NodeJS.Timeout;
 
   prisma: WebhookDatabase;
+  private readonly replica: WebhookReplicaDatabase;
 
   private triggerTask: TriggerWebhookTaskCallback;
   private waiterStore!: WebhookWaiterStore;
   private readonly waiterLimits: WebhookWaiterLimits;
-  // Caches the endpoint + resolved signing secret per opaqueId so the ingest hot path skips two
-  // Postgres reads (endpoint lookup + secret decrypt). Both are immutable per endpoint within the
-  // TTL; a status change or secret rotation takes effect after at most the TTL.
-  private endpointCache: TtlCache<CachedEndpoint>;
 
   constructor(private readonly options: WebhookEngineOptions) {
     this.logger =
       options.logger ?? new Logger("WebhookEngine", (this.options.logLevel ?? "info") as any);
     this.prisma = options.prisma;
+    this.replica = options.replica ?? options.prisma;
     this.triggerTask = options.triggerTask;
     this.waiterLimits = { ...DEFAULT_WAITER_LIMITS, ...options.waiters?.limits };
 
@@ -257,9 +261,6 @@ export class WebhookEngine {
     this.ensurePartitionsCounter = this.meter.createCounter("webhook_ensure_partitions_total", {
       description: "Total number of ensurePartitions cron runs",
     });
-    this.endpointCacheCounter = this.meter.createCounter("webhook_endpoint_cache_total", {
-      description: "Endpoint+secret cache lookups on the ingest hot path, by result (hit/miss)",
-    });
     this.ingestCounter = this.meter.createCounter("webhook_ingest_total", {
       description:
         "Webhook requests received, by path (endpoint or a waiter's own URL) and outcome (accepted, duplicate, verification_failed, ...)",
@@ -300,11 +301,6 @@ export class WebhookEngine {
       result.observe((this.partitionsCoveredUntil.getTime() - Date.now()) / DAY_MS);
     });
 
-    this.endpointCache = new TtlCache<CachedEndpoint>(
-      options.endpointCache?.ttlMs ?? 30_000,
-      options.endpointCache?.maxSize ?? 10_000
-    );
-
     if (options.disabled) {
       this.logger.info("Webhook engine disabled; skipping Redis and worker setup");
       return;
@@ -385,9 +381,6 @@ export class WebhookEngine {
     return startSpan(this.tracer, "webhook.ingest", async (span) => {
       span.setAttribute("opaqueId", input.opaqueId);
 
-      // 1+2. Resolve the endpoint + signing secret (cached per opaqueId). Fail-closed outcomes
-      // (not found / inactive / secret missing) are never cached, so verify only ever runs with a
-      // non-empty secret.
       const resolved = await this.#resolveEndpoint(input.opaqueId);
       if (!resolved.ok) return resolved.result;
       const { endpoint, secrets } = resolved;
@@ -661,7 +654,7 @@ export class WebhookEngine {
     this.#assertEnabled();
     return startSpan(this.tracer, "webhook.unsupportedMethod", async (span) => {
       span.setAttribute("opaqueId", opaqueId);
-      const endpoint = await this.prisma.webhookEndpoint.findFirst({
+      const endpoint = await this.replica.webhookEndpoint.findFirst({
         where: { opaqueId },
         select: { status: true, verifierArtifact: true },
       });
@@ -693,7 +686,7 @@ export class WebhookEngine {
     return startSpan(this.tracer, "webhook.getHandshake", async (span) => {
       span.setAttribute("opaqueId", input.opaqueId);
 
-      const endpoint = await this.prisma.webhookEndpoint.findFirst({
+      const endpoint = await this.replica.webhookEndpoint.findFirst({
         where: { opaqueId: input.opaqueId },
       });
       if (!endpoint) return { outcome: "endpoint_not_found" };
@@ -1239,20 +1232,11 @@ export class WebhookEngine {
     });
   }
 
-  // Resolve the endpoint + plaintext signing secret for an opaqueId, cached. Only fully-resolved
-  // (ACTIVE + secret present) endpoints are cached; fail-closed outcomes always re-read.
   async #resolveEndpoint(
     opaqueId: string
-  ): Promise<({ ok: true } & CachedEndpoint) | { ok: false; result: IngestResult }> {
-    const cached = this.endpointCache.get(opaqueId);
-    if (cached) {
-      this.endpointCacheCounter.add(1, { result: "hit" });
-      return { ok: true, ...cached };
-    }
-    this.endpointCacheCounter.add(1, { result: "miss" });
-
+  ): Promise<({ ok: true } & ResolvedEndpoint) | { ok: false; result: IngestResult }> {
     // Single-row via the global @unique on opaqueId (Q2).
-    const endpoint = await this.prisma.webhookEndpoint.findFirst({ where: { opaqueId } });
+    const endpoint = await this.replica.webhookEndpoint.findFirst({ where: { opaqueId } });
     if (!endpoint) return { ok: false, result: { outcome: "endpoint_not_found" } };
     if (endpoint.status !== "ACTIVE")
       return { ok: false, result: { outcome: "endpoint_inactive" } };
@@ -1277,9 +1261,7 @@ export class WebhookEngine {
 
     const targets = parseRoutingTargets(endpoint, this.logger);
 
-    const secrets: CachedEndpoint["secrets"] = [secret, ...previousSecrets];
-    this.endpointCache.set(opaqueId, { endpoint, secrets, targets });
-    return { ok: true, endpoint, secrets, targets };
+    return { ok: true, endpoint, secrets: [secret, ...previousSecrets], targets };
   }
 
   // Evaluate a session routing target's `startOn` against the event. Absent => start allowed. A parse or
 
@@ -4,7 +4,7 @@ import {
   createStandalonePostgresContainer,
 } from "@internal/testcontainers";
 import { createRedisClient } from "@internal/redis";
-import { type Prisma, PrismaClient } from "@trigger.dev/database";
+import { type Prisma, PrismaClient, type WebhookReplicaDatabase } from "@trigger.dev/database";
 import type { RedisOptions } from "@internal/redis";
 import type { Meter } from "@internal/tracing";
 import {
@@ -161,27 +161,26 @@ function buildEngine(
   triggerTask: TriggerWebhookTaskCallback,
   over?: {
     workerDisabled?: boolean;
-    endpointCacheTtlMs?: number;
     resolveSigningSecret?: (key: string) => Promise<string | readonly string[] | undefined>;
     resolveVerifyToken?: (endpointId: string) => Promise<string | undefined>;
     deliverToSession?: DeliverWebhookToSessionCallback;
     meter?: Meter;
     retentionDays?: (environmentId: string) => Promise<number>;
+    replica?: WebhookReplicaDatabase;
   }
 ) {
   return new WebhookEngine({
     meter: over?.meter,
     resolveVerifyToken: over?.resolveVerifyToken,
     prisma,
+    replica: over?.replica,
     redis: redisOptions,
     worker: {
       concurrency: 1,
       pollIntervalMs: 50,
       disabled: over?.workerDisabled,
       retryBaseDelayMs: 20,
     },
-    endpointCache:
-      over?.endpointCacheTtlMs !== undefined ? { ttlMs: over.endpointCacheTtlMs } : undefined,
     triggerTask,
     deliverToSession: over?.deliverToSession,
     retention: over?.retentionDays ? { forEnvironment: over.retentionDays } : undefined,
@@ -773,35 +772,73 @@ containerTestWithIsolatedRedis(
 );
 
 containerTestWithIsolatedRedis(
-  "caches the endpoint + secret across ingests and re-reads after the TTL",
+  "resolves the endpoint and secret on every ingest, so a new secret applies to the next delivery",
   async ({ prisma, redisOptions }) => {
     const endpoint = await createEndpoint(prisma);
     const { triggerTask } = makeTriggerTaskStub();
+    let secret = SECRET;
     let secretReads = 0;
     const engine = buildEngine(prisma, redisOptions, triggerTask, {
-      endpointCacheTtlMs: 200,
       resolveSigningSecret: async (key) => {
         secretReads++;
-        return key === SECRET_KEY ? SECRET : undefined;
+        return key === SECRET_KEY ? secret : undefined;
       },
     });
 
     try {
-      expect((await engine.ingest(signedInput("evt_cache_1", endpoint.opaqueId))).outcome).toBe(
+      expect((await engine.ingest(signedInput("evt_fresh_1", endpoint.opaqueId))).outcome).toBe(
         "accepted"
       );
-      expect((await engine.ingest(signedInput("evt_cache_2", endpoint.opaqueId))).outcome).toBe(
+      expect((await engine.ingest(signedInput("evt_fresh_2", endpoint.opaqueId))).outcome).toBe(
         "accepted"
       );
-      // Second ingest hit the cache, so the secret was resolved only once.
-      expect(secretReads).toBe(1);
+      expect(secretReads).toBe(2);
 
-      // After the TTL the entry expires and the next ingest re-resolves.
-      await new Promise((r) => setTimeout(r, 250));
-      expect((await engine.ingest(signedInput("evt_cache_3", endpoint.opaqueId))).outcome).toBe(
-        "accepted"
+      secret = "whsec_rotated_secret";
+      expect((await engine.ingest(signedInput("evt_fresh_3", endpoint.opaqueId))).outcome).toBe(
+        "verification_failed"
       );
-      expect(secretReads).toBe(2);
+
+      await prisma.webhookEndpoint.update({
+        where: { id: endpoint.id },
+        data: { status: "INACTIVE" },
+      });
+      expect((await engine.ingest(signedInput("evt_fresh_4", endpoint.opaqueId))).outcome).toBe(
+        "endpoint_inactive"
+      );
+    } finally {
+      await engine.quit();
+    }
+  }
+);
+
+containerTestWithIsolatedRedis(
+  "reads the endpoint for public ingress from the replica, not the writer",
+  async ({ prisma, redisOptions }) => {
+    const endpoint = await createEndpoint(prisma);
+    const { triggerTask } = makeTriggerTaskStub();
+    const replicaReads: string[] = [];
+    const laggingReplica = {
+      webhookEndpoint: {
+        findFirst: async (args: { where: { opaqueId: string } }) => {
+          replicaReads.push(args.where.opaqueId);
+          return null;
+        },
+      },
+    } as unknown as WebhookReplicaDatabase;
+    const engine = buildEngine(prisma, redisOptions, triggerTask, { replica: laggingReplica });
+
+    try {
+      expect((await engine.ingest(signedInput("evt_replica_1", endpoint.opaqueId))).outcome).toBe(
+        "endpoint_not_found"
+      );
+      expect((await engine.rejectUnsupportedMethod(endpoint.opaqueId)).outcome).toBe(
+        "endpoint_not_found"
+      );
+      expect(
+        (await engine.verifyGetHandshake({ opaqueId: endpoint.opaqueId, query: {} })).outcome
+      ).toBe("endpoint_not_found");
+      expect(replicaReads).toEqual([endpoint.opaqueId, endpoint.opaqueId, endpoint.opaqueId]);
     } finally {
       await engine.quit();
     }
@@ -815,7 +852,6 @@ containerTestWithIsolatedRedis(
     const { triggerTask } = makeTriggerTaskStub();
     let secrets: string[] = ["whsec_rotated_secret", SECRET];
     const engine = buildEngine(prisma, redisOptions, triggerTask, {
-      endpointCacheTtlMs: 0,
       resolveSigningSecret: async (key) => (key === SECRET_KEY ? secrets : undefined),
     });