diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1dddf9e..95a366a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,6 +61,7 @@ jobs:
       REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
       REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
       JWT_SECRET_KEY: ${{ secrets.JWT_SECRET_KEY }}
+      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
       QA_ADMIN_PORT: ${{ vars.QA_ADMIN_PORT }}
     steps:
       # actions/checkout@v4 is a Node-based action; this runner has no node
@@ -81,6 +82,7 @@ jobs:
     runs-on: [self-hosted, qa]
     env:
       QA_ADMIN_PORT: ${{ vars.QA_ADMIN_PORT }}
+      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
     steps:
       # actions/checkout@v4 is a Node-based action; this runner has no node
       # in PATH, so checkout plain git instead of via marketplace action.
diff --git a/deploy/qa/.env.example b/deploy/qa/.env.example
index 5fa2c5e..7d15785 100644
--- a/deploy/qa/.env.example
+++ b/deploy/qa/.env.example
@@ -9,4 +9,5 @@ REGISTRY_TOKEN=changeme
 
 # QA environment
 JWT_SECRET_KEY=change-this-to-a-random-32-plus-char-secret
+POSTGRES_PASSWORD=change-this-to-a-random-password
 QA_ADMIN_PORT=3001
diff --git a/deploy/qa/docker-compose.qa.yml b/deploy/qa/docker-compose.qa.yml
index ca1c4f2..3d9ed02 100644
--- a/deploy/qa/docker-compose.qa.yml
+++ b/deploy/qa/docker-compose.qa.yml
@@ -13,7 +13,7 @@ services:
     environment:
       POSTGRES_DB: miccheck
       POSTGRES_USER: miccheck
-      POSTGRES_PASSWORD: password
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
     ports:
       - "${DB_BIND_HOST:-127.0.0.1}:55432:5432"
     volumes:
@@ -31,7 +31,7 @@ services:
     environment:
       ASPNETCORE_ENVIRONMENT: Development
       ASPNETCORE_URLS: http://+:8080
-      ConnectionStrings__miccheck: "Host=db;Database=miccheck;Username=miccheck;Password=password"
+      ConnectionStrings__miccheck: "Host=db;Database=miccheck;Username=miccheck;Password=${POSTGRES_PASSWORD}"
       Jwt__SecretKey: ${JWT_SECRET_KEY}
       Jwt__Issuer: MicCheck
       Jwt__Audience: MicCheck
diff --git a/scripts/ci/deploy-qa.sh b/scripts/ci/deploy-qa.sh
index 91715cb..6817cb1 100755
--- a/scripts/ci/deploy-qa.sh
+++ b/scripts/ci/deploy-qa.sh
@@ -11,6 +11,7 @@ registry_login
 
 export API_IMAGE ADMIN_IMAGE
 export JWT_SECRET_KEY="${JWT_SECRET_KEY:?JWT_SECRET_KEY env var is required}"
+export POSTGRES_PASSWORD="${POSTGRES_PASSWORD:?POSTGRES_PASSWORD env var is required}"
 export QA_ADMIN_PORT="${QA_ADMIN_PORT:-3001}"
 
 # Bind narrowly to docker's bridge gateway IP rather than 0.0.0.0: reachable
diff --git a/scripts/ci/smoke-qa.sh b/scripts/ci/smoke-qa.sh
index 8c986a4..95217fe 100755
--- a/scripts/ci/smoke-qa.sh
+++ b/scripts/ci/smoke-qa.sh
@@ -22,7 +22,7 @@ BASE_URL="http://${CI_HOST}:${QA_ADMIN_PORT}"
 log "Resolved docker host as $CI_HOST for reaching the QA stack's published ports"
 
 export MICCHECK_API_BASE_URL="$BASE_URL"
-export MICCHECK_DB_CONNECTION_STRING="${MICCHECK_DB_CONNECTION_STRING:-Host=$CI_HOST;Port=55432;Database=miccheck;Username=miccheck;Password=password}"
+export MICCHECK_DB_CONNECTION_STRING="${MICCHECK_DB_CONNECTION_STRING:-Host=$CI_HOST;Port=55432;Database=miccheck;Username=miccheck;Password=${POSTGRES_PASSWORD:?POSTGRES_PASSWORD env var is required}}"
 
 log "Running API integration suite against $BASE_URL"
 dotnet test tests/api/MicCheck.Api.Tests.Integration/MicCheck.Api.Tests.Integration.csproj -c Release --logger trx