diff --git a/flask_app.py b/flask_app.py
index e731975..9527b22 100644
--- a/flask_app.py
+++ b/flask_app.py
@@ -49,6 +49,8 @@ DB_PORT = int(env("DB_PORT", "5432") or "5432")
 DB_NAME = env("DB_NAME", "").strip()
 DB_USER = env("DB_USER", "").strip()
 DB_PASSWORD = env("DB_PASSWORD", "").strip()
+DB_SSLMODE = env("DB_SSLMODE", "prefer").strip() or "prefer"
+DB_CONNECT_TIMEOUT = int(env("DB_CONNECT_TIMEOUT", "5") or "5")
 
 TABLE = safe_ident(env("TABLE", "ncue_user") or "ncue_user")
 CONFIG_TABLE = "ncue_app_config"
@@ -90,7 +92,8 @@ def get_pool() -> psycopg2.pool.SimpleConnectionPool:
         dbname=DB_NAME,
         user=DB_USER,
         password=DB_PASSWORD,
-        sslmode="disable",
+        sslmode=DB_SSLMODE,
+        connect_timeout=DB_CONNECT_TIMEOUT,
     )
     return _POOL
 
@@ -268,7 +271,8 @@ def healthz() -> Response:
             return jsonify({"ok": False}), 500
         return jsonify({"ok": True})
     except Exception:
-        return jsonify({"ok": False}), 500
+        # Keep response minimal but actionable
+        return jsonify({"ok": False, "error": "db_connect_failed"}), 500
 
 
 @app.post("/api/auth/sync")