diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 24d75b2f..b743d49b 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
       run:
         shell: bash
     env:
-      QE_WBS_PG_DSN: "host=postgres port=5432 dbname=quantenginedb user=quantengine_ci password=quantengine_ci options='-c search_path=quantengine'"
+      QE_WBS_PG_DSN: "host=postgres port=5432 dbname=quantenginedb user=quantengine_ci password=quantengine_ci options='-c search_path=quantengine' sslmode=disable"
       PGPASSWORD: quantengine_ci
       PGHOST: postgres
       PGPORT: 5432
diff --git a/tools/validate_gitea_ci_workflow_lint_v1.py b/tools/validate_gitea_ci_workflow_lint_v1.py
index 3f790524..8cf9267b 100644
--- a/tools/validate_gitea_ci_workflow_lint_v1.py
+++ b/tools/validate_gitea_ci_workflow_lint_v1.py
@@ -44,7 +44,7 @@ def main() -> int:
     if "PGHOST: postgres" not in ci_text:
         errors.append("workflow does not pin PGHOST=postgres for CI database steps")
 
-    if "QE_WBS_PG_DSN=host=postgres" not in ci_text:
+    if "QE_WBS_PG_DSN:" not in ci_text or "host=postgres" not in ci_text:
         errors.append("workflow does not publish QE_WBS_PG_DSN with service hostname")
 
     spec_path = ROOT / "spec" / "60_quant_engine_wbs.yaml"