diff --git a/.crow/reindex.yaml b/.crow/reindex.yaml
index b13245a..528def4 100644
--- a/.crow/reindex.yaml
+++ b/.crow/reindex.yaml
@@ -142,6 +142,13 @@ steps:
         from_secret: B2_S3_ACCESS_KEY
       B2_S3_SECRET_KEY:
         from_secret: B2_S3_SECRET_KEY
+      # The index build reads the ABI classifier cache to decide which packages
+      # may be carried from the flat slot into a per-minor one. Without the
+      # password that query fails, and it fails soft, so the run still succeeds
+      # while quietly using an empty risky set: exactly the state the cache was
+      # added to fix. It logs one connection error per slot.
+      PGPASS:
+        from_secret: PGPASS
       REPO_RO_TOKEN:
         from_secret: REPO_RO_TOKEN
       GIT_USER: pat-s
diff --git a/.crow/weekly-rebuild-reindex.yaml b/.crow/weekly-rebuild-reindex.yaml
index c9f9a8a..8de71f7 100644
--- a/.crow/weekly-rebuild-reindex.yaml
+++ b/.crow/weekly-rebuild-reindex.yaml
@@ -145,6 +145,13 @@ steps:
         from_secret: B2_S3_ACCESS_KEY
       B2_S3_SECRET_KEY:
         from_secret: B2_S3_SECRET_KEY
+      # The index build reads the ABI classifier cache to decide which packages
+      # may be carried from the flat slot into a per-minor one. Without the
+      # password that query fails, and it fails soft, so the run still succeeds
+      # while quietly using an empty risky set: exactly the state the cache was
+      # added to fix. It logs one connection error per slot.
+      PGPASS:
+        from_secret: PGPASS
       REPO_RO_TOKEN:
         from_secret: REPO_RO_TOKEN
       GIT_USER: pat-s