diff --git a/internal/modulecontext/from_secrets.go b/internal/modulecontext/from_secrets.go
index 8bcb474848..ff8d56e1ea 100644
--- a/internal/modulecontext/from_secrets.go
+++ b/internal/modulecontext/from_secrets.go
@@ -4,6 +4,8 @@ import (
 	"context"
 	"fmt"
 	"strings"
+
+	"github.com/TBD54566975/ftl/go-runtime/encoding"
 )
 
 // DatabasesFromSecrets finds DSNs in secrets and creates a map of databases.
@@ -25,8 +27,10 @@ func DatabasesFromSecrets(ctx context.Context, module string, secrets map[string
 		if !strings.EqualFold(moduleName, module) {
 			continue
 		}
-		dsnStr := string(maybeDSN)
-		dsn := dsnStr[1 : len(dsnStr)-1] // chop leading + trailing quotes
+		var dsn string
+		if err := encoding.Unmarshal(maybeDSN, &dsn); err != nil {
+			return nil, fmt.Errorf("could not unmarshal DSN %q: %w", maybeDSN, err)
+		}
 		db, err := NewDatabase(DBTypePostgres, dsn)
 		if err != nil {
 			return nil, fmt.Errorf("could not create database %q with DSN %q: %w", dbName, maybeDSN, err)
diff --git a/internal/modulecontext/from_secrets_test.go b/internal/modulecontext/from_secrets_test.go
index 971b99b09b..e200d3587c 100644
--- a/internal/modulecontext/from_secrets_test.go
+++ b/internal/modulecontext/from_secrets_test.go
@@ -4,16 +4,18 @@ import (
 	"context" //nolint:depguard
 	"testing"
 
+	"github.com/alecthomas/assert/v2"
+
 	ftlv1 "github.com/TBD54566975/ftl/backend/protos/xyz/block/ftl/v1"
 	"github.com/TBD54566975/ftl/internal/log"
-	"github.com/alecthomas/assert/v2"
 )
 
 func TestFromSecrets(t *testing.T) {
 	ctx := log.ContextWithNewDefaultLogger(context.Background())
 
 	secrets := map[string][]byte{
-		"FTL_DSN_ECHO_ECHO": []byte("\"postgres://echo:echo@localhost:5432/echo\""),
+		"FTL_DSN_ECHO_ECHO": []byte(`"postgres://echo:echo@localhost:5432/echo?sslmode=disable\u0026user=echo\u0026password=echo"
+`),
 	}
 	databases, err := DatabasesFromSecrets(ctx, "echo", secrets)
 	assert.NoError(t, err)
@@ -24,7 +26,7 @@ func TestFromSecrets(t *testing.T) {
 		Configs: map[string][]byte{},
 		Secrets: map[string][]byte{},
 		Databases: []*ftlv1.ModuleContextResponse_DSN{
-			{Name: "echo", Dsn: "postgres://echo:echo@localhost:5432/echo"},
+			{Name: "echo", Dsn: `postgres://echo:echo@localhost:5432/echo?sslmode=disable&user=echo&password=echo`},
 		},
 	}, response)
 }