diff --git a/hosts/bicep/services/postgresql/default.nix b/hosts/bicep/services/postgresql/default.nix
index 2ae2429..e48d599 100644
--- a/hosts/bicep/services/postgresql/default.nix
+++ b/hosts/bicep/services/postgresql/default.nix
@@ -14,6 +14,7 @@ in
     extensions = ps: with ps; [ pg_repack ];
     enableTCPIP = true;
 
+    # NOTE: md5 accepts both md5 and scram-sha-256
     authentication = ''
       host all all ${values.ipv4-space} md5
       host all all ${values.ipv6-space} md5
@@ -76,6 +77,9 @@ in
       maintenance_io_concurrency = 100;
       wal_recycle = true;
 
+      # Authentication
+      password_encryption = "scram-sha-256";
+
       # SSL
       ssl = true;
       ssl_cert_file = "/run/credentials/postgresql.service/cert";