diff --git a/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx b/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
index a65acf74..8ff49d35 100644
--- a/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
+++ b/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
@@ -110,6 +110,8 @@ The installer stores everything in its own PostgreSQL container, except the embe
 
    Leave `encryptionKey` exactly as the installer wrote it. It encrypts data in the database, and a different value makes that data unreadable.
 
+   The installer's DSN uses `sslmode=disable`, because its database runs on the same host. Across the network, use `sslmode=require`, which encrypts the connection. Do not use `verify-ca` or `verify-full` with `sslrootcert` for now: the embedded identity provider ignores `sslrootcert`, and the server stops at startup with `x509: certificate signed by unknown authority`.
+
 5. Move the login data from `idp.db` into the endpoint. The NetBird image includes a tool for this:
 
    ```bash
@@ -329,6 +331,10 @@ For more failure tests and day-to-day operations, see the [High Availability gui
 
 Your PostgreSQL endpoint runs a version older than 17. The installer's backup comes from PostgreSQL 17 and does not restore into older versions. Use an endpoint running PostgreSQL 17 or later.
 
+### The server stops at startup with `failed to create embedded IDP service` and `x509: certificate signed by unknown authority`
+
+The DSNs use `sslmode=verify-ca` or `verify-full` with `sslrootcert`. The main database connection accepts that, but the embedded identity provider ignores `sslrootcert` and checks the database's certificate against the system trust store. Use `sslmode=require`, as in Step 1.
+
 ### `profile: command not found` when reading `.env`
 
 The shell tried to `source` the installer's `.env`. Read single values with `grep` instead, as in Step 1.