diff --git a/.github/workflows/deploy-changed-samples.yml b/.github/workflows/deploy-changed-samples.yml
index ee483fb0..1fc9576f 100644
--- a/.github/workflows/deploy-changed-samples.yml
+++ b/.github/workflows/deploy-changed-samples.yml
@@ -75,6 +75,7 @@ jobs:
           TEST_DATABASE_PASSWORD: ${{ secrets.TEST_DATABASE_PASSWORD }}
           TEST_DATABASE_URL: ${{ secrets.TEST_DATABASE_URL }}
           TEST_DATABASE_USERNAME: ${{ secrets.TEST_DATABASE_USERNAME }}
+          TEST_DB_SSL: ${{ secrets.TEST_DB_SSL }}
           TEST_DB_POSTGRESDB_PASSWORD: ${{ secrets.TEST_POSTGRES_PASSWORD }}
           TEST_DB_POSTGRESDB_SSL_ENABLED: ${{ secrets.TEST_DB_POSTGRESDB_SSL_ENABLED }}
           TEST_DB_POSTGRESDB_SSL_REJECT_UNAUTHORIZED: ${{ secrets.TEST_DB_POSTGRESDB_SSL_REJECT_UNAUTHORIZED }}
diff --git a/samples/mastra-nextjs/.github/workflows/deploy.yaml b/samples/mastra-nextjs/.github/workflows/deploy.yaml
index a46fd518..fc76b2f1 100644
--- a/samples/mastra-nextjs/.github/workflows/deploy.yaml
+++ b/samples/mastra-nextjs/.github/workflows/deploy.yaml
@@ -20,8 +20,9 @@ jobs:
       - name: Deploy
         uses: DefangLabs/defang-github-action@v1.2.0
         with:
-          config-env-vars: POSTGRES_PASSWORD LLM_MODEL GITHUB_TOKEN
+          config-env-vars: DB_SSL POSTGRES_PASSWORD LLM_MODEL GITHUB_TOKEN
         env:
+          DB_SSL: ${{ secrets.DB_SSL }}
           POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
           LLM_MODEL: ${{ secrets.LLM_MODEL }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/samples/mastra-nextjs/README.md b/samples/mastra-nextjs/README.md
index dd3169c3..00136ccb 100644
--- a/samples/mastra-nextjs/README.md
+++ b/samples/mastra-nextjs/README.md
@@ -60,7 +60,9 @@ The large language model to use for the AI-powered chat. This can be set to mode
 
 ### `DB_SSL`
 
-Set to `true` to enable SSL. Set to `false` to disable SSL, which is used for Defang Playground. (Can be set directly in the Docker Compose file.)
+_You can easily set this using `defang config set DB_SSL=<true|false>`_
+
+Set to `true` to enable SSL for AWS and GCP. Set to `false` to disable SSL, which is used for Defang Playground.
 
 ### `GITHUB_TOKEN` (Optional)
 
diff --git a/samples/mastra-nextjs/compose.yaml b/samples/mastra-nextjs/compose.yaml
index 1284d318..6f6c9c6b 100644
--- a/samples/mastra-nextjs/compose.yaml
+++ b/samples/mastra-nextjs/compose.yaml
@@ -6,9 +6,9 @@ services:
       dockerfile: Dockerfile
     environment:
       - DB_URL=postgres://postgres:${POSTGRES_PASSWORD}@database:5432/postgres
-      - DB_SSL=false # set this to false if deploying to defang playground, true otherwise
-      - LLM_MODEL # gemini-2.5-flash for GCP, anthropic.claude-3-5-sonnet-20241022-v2:0 for AWS
-      - GITHUB_TOKEN # optional, remove this line if unused
+      - DB_SSL # set this to true if deploying to AWS and GCP, otherwise it is false deploying to Defang Playground
+      - LLM_MODEL # recommended gemini-2.5-flash for GCP or anthropic.claude-3-5-sonnet-20241022-v2:0 for AWS
+      - GITHUB_TOKEN # remove this line if unused; optional, but recommended to avoid rate limiting when fetching from GitHub
     restart: unless-stopped
     ports:
       - mode: ingress