diff --git a/vm/legacy-api/apply.sh b/vm/legacy-api/apply.sh
index 11e7ecf..d3d2b53 100755
--- a/vm/legacy-api/apply.sh
+++ b/vm/legacy-api/apply.sh
@@ -15,7 +15,7 @@ unset TOKEN
 ENV_FILE=/opt/selfheal/legacy-api.env
 umask 077
 {
-  printf 'DB_DSN=postgres://app:%s@10.20.0.20:5432/app?sslmode=prefer\n' "${DB_PASSWORD}"
+  printf 'DB_DSN=postgres://app:%s@10.20.0.20:5432/app?sslmode=require\n' "${DB_PASSWORD}"
 } > "$ENV_FILE"
 unset DB_PASSWORD
 docker compose --env-file "$ENV_FILE" -f compose.yaml up -d --pull always --remove-orphans