diff --git a/.crow/build-all-versions.yaml b/.crow/build-all-versions.yaml
index ce3bc09..c5dc8b9 100644
--- a/.crow/build-all-versions.yaml
+++ b/.crow/build-all-versions.yaml
@@ -193,6 +193,10 @@ steps:
         from_secret: B2_S3_ACCESS_KEY
       B2_S3_SECRET_KEY:
         from_secret: B2_S3_SECRET_KEY
+      # A per-minor index reads the ABI classifier cache and the flat-object
+      # safety table from the build database, and is not republished without it.
+      PGPASS:
+        from_secret: PGPASS
       R_LIBS_USER: /mnt/cache/R-pkgs
     volumes:
       - ${ARCH}-binaries-r-dep-cache-${OS}-${OS_VERSION//./}:/mnt/cache
@@ -200,10 +204,15 @@ steps:
       - |
         CODENAME=$(/opt/R/$R_VERSION/bin/Rscript -e "cat(bincraft::set_codename(NULL))")
         /opt/R/$R_VERSION/bin/R -q -e "bincraft::upload_package_index(codename = '$CODENAME', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))"
+        FAILED_MINORS=""
         for RBIN in /opt/R/[0-9]*/bin/R; do
           RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2)
-          /opt/R/$R_VERSION/bin/R -q -e "bincraft::upload_package_index(codename = '$CODENAME', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))" || true
+          /opt/R/$R_VERSION/bin/R -q -e "bincraft::upload_package_index(codename = '$CODENAME', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full')" || FAILED_MINORS="$FAILED_MINORS $RMINOR"
         done
+        if [ -n "$FAILED_MINORS" ]; then
+          echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2
+          exit 1
+        fi
     backend_options:
       docker:
         resources:
diff --git a/.crow/process-updates.yaml b/.crow/process-updates.yaml
index 531a47f..59f2f33 100644
--- a/.crow/process-updates.yaml
+++ b/.crow/process-updates.yaml
@@ -194,7 +194,7 @@ steps:
       # rhel-10 ships xwfb-run (Xwayland) instead of xvfb-run; prefer it and start weston, else fall back to xvfb-run
       - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS="-a"; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi
       # options(future.globals.onReference = NULL): for some reason s3fs::file_delete() throws 'Error: Detected a non-exportable reference ('externalptr') in one of the globals ('FUN' of class 'function') used in the future expression' otherwise
-      - $XVFB $XVFB_ARGS -- /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = '${OS}', process_updated = TRUE, process_new = ${PROCESS_NEW}, process_removed = TRUE, patches = 'local/patches', r_minor_detection = 'classifier',s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)"
+      - $XVFB $XVFB_ARGS -- /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = '${OS}', process_updated = TRUE, process_new = ${PROCESS_NEW}, process_removed = TRUE, patches = 'local/patches', r_minor_detection = 'classifier',s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)"
       - |
         PRIMARY_MINOR=$(echo "$R_VERSION" | cut -d. -f1-2)
         for RBIN in /opt/R/[0-9]*/bin/R; do
@@ -206,16 +206,21 @@ steps:
           mkdir -p "$LIB"
           R_LIBS_USER="$LIB" "$(dirname "$RBIN")/Rscript" local/install-bincraft.R || true
           R_LIBS_USER="$LIB" UVR_R_BIN="$RBIN" local/uvr-install.sh RPostgres || true
-          R_LIBS_USER="$LIB" $XVFB $XVFB_ARGS -- "$(dirname "$RBIN")/R" -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = '${OS}', process_updated = TRUE, process_new = FALSE, process_removed = FALSE, patches = 'local/patches', r_minor_detection = 'classifier',r_minor_sensitive_only = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)" || true
+          R_LIBS_USER="$LIB" $XVFB $XVFB_ARGS -- "$(dirname "$RBIN")/R" -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = '${OS}', process_updated = TRUE, process_new = FALSE, process_removed = FALSE, patches = 'local/patches', r_minor_detection = 'classifier',r_minor_sensitive_only = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)" || true
           # Also build current packages whose required dependency tree needs a newer R.
           R_LIBS_USER="$LIB" $XVFB $XVFB_ARGS -- "$(dirname "$RBIN")/Rscript" local/build-newer-r.R "$R_VERSION"
         done
       - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(codename = "${OS_ID}", s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
       - |
+        FAILED_MINORS=""
         for RBIN in /opt/R/[0-9]*/bin/R; do
           RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2)
-          /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(codename = '${OS_ID}', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))" || true
+          /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(codename = '${OS_ID}', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full')" || FAILED_MINORS="$FAILED_MINORS $RMINOR"
         done
+        if [ -n "$FAILED_MINORS" ]; then
+          echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2
+          exit 1
+        fi
     backend_options:
       docker:
         resources:
@@ -242,3 +247,7 @@ steps:
     commands:
       - apk add --no-cache -q bash curl
       - bash scripts/purge_cdn_cache.sh "$BUNNYNET_API_KEY" "$ARCH" "$OS_ID" "$SUBDOMAIN1" "$SUBDOMAIN2" "$SUBDOMAIN3"
+    # Run it even when a per-minor re-index above failed: the generic index
+    # and the objects were still replaced, and a stale edge keeps them hidden.
+    when:
+      - status: [success, failure]
diff --git a/.crow/prune-stale-flat-binaries.yaml b/.crow/prune-stale-flat-binaries.yaml
index 79ca003..dc33a9a 100644
--- a/.crow/prune-stale-flat-binaries.yaml
+++ b/.crow/prune-stale-flat-binaries.yaml
@@ -209,10 +209,15 @@ steps:
           exit 0
         fi
         /opt/R/4.5.3/bin/R -q -e 'library(bincraft); upload_package_index(s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
+        FAILED_MINORS=""
         for RBIN in /opt/R/[0-9]*/bin/R; do
           RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2)
-          /opt/R/4.5.3/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))" || true
+          /opt/R/4.5.3/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full')" || FAILED_MINORS="$FAILED_MINORS $RMINOR"
         done
+        if [ -n "$FAILED_MINORS" ]; then
+          echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2
+          exit 1
+        fi
     backend_options:
       docker:
         resources:
@@ -240,3 +245,7 @@ steps:
         fi
         apk add --no-cache -q bash curl jq
         bash scripts/purge_cdn_zone.sh "$BUNNYNET_API_KEY" $BUNNY_PULLZONES
+    # Run it even when a per-minor re-index above failed: the generic index
+    # and the objects were still replaced, and a stale edge keeps them hidden.
+    when:
+      - status: [success, failure]
diff --git a/.crow/reindex.yaml b/.crow/reindex.yaml
index 803d9a5..5d61ca4 100644
--- a/.crow/reindex.yaml
+++ b/.crow/reindex.yaml
@@ -162,10 +162,15 @@ steps:
       # The codename is detected from the image's /etc/os-release.
       - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
       - |
+        FAILED_MINORS=""
         for RBIN in /opt/R/[0-9]*/bin/R; do
           RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2)
-          /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))" || true
+          /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full')" || FAILED_MINORS="$FAILED_MINORS $RMINOR"
         done
+        if [ -n "$FAILED_MINORS" ]; then
+          echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2
+          exit 1
+        fi
 
   - name: Purge CDN cache
     image: reg.devxy.io/docker.io/library/alpine:3.24
diff --git a/.crow/weekly-rebuild-reindex.yaml b/.crow/weekly-rebuild-reindex.yaml
index 698f503..9e53848 100644
--- a/.crow/weekly-rebuild-reindex.yaml
+++ b/.crow/weekly-rebuild-reindex.yaml
@@ -165,10 +165,15 @@ steps:
       # The codename is detected from the image's /etc/os-release.
       - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))'
       - |
+        FAILED_MINORS=""
         for RBIN in /opt/R/[0-9]*/bin/R; do
           RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2)
-          /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))" || true
+          /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full')" || FAILED_MINORS="$FAILED_MINORS $RMINOR"
         done
+        if [ -n "$FAILED_MINORS" ]; then
+          echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2
+          exit 1
+        fi
 
   - name: Purge CDN cache
     image: reg.devxy.io/docker.io/library/alpine:3.24
diff --git a/README.md b/README.md
index 99d1143..81fd67b 100644
--- a/README.md
+++ b/README.md
@@ -139,6 +139,7 @@ For Alpine, no rules existed until recently, establishing a foundation for semi-
 
 The build metadata is stored in a PostgreSQL database.
 The database has a public endpoint at `r-binaries.devxy.io` and port `15432`.
+It serves a Let's Encrypt certificate for that name, so connect with `sslmode=verify-full`; from R, pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")` as well, since libpq does not read the system trust store by default.
 It contains one table named `single_builds`, which holds the build metadata for each package:
 
 | package_name | tag | platform | error_occurred | build_timestamp | build_duration | error | size | removed |
diff --git a/local/backfill-abi-classification.R b/local/backfill-abi-classification.R
index 0f48392..c964a86 100644
--- a/local/backfill-abi-classification.R
+++ b/local/backfill-abi-classification.R
@@ -47,7 +47,7 @@ db <- list(
   metadata_db_port = 15432L,
   metadata_db_user = "rpkgs",
   metadata_db_password = Sys.getenv("PGPASS"),
-  metadata_db_sslmode = "require"
+  metadata_db_sslmode = "verify-full"
 )
 
 read_index <- function(index_url) {
diff --git a/local/build-all.R b/local/build-all.R
index 349092f..bd1aefb 100644
--- a/local/build-all.R
+++ b/local/build-all.R
@@ -152,7 +152,8 @@ con <- DBI::dbConnect(
   port = 15432,
   user = "rpkgs",
   password = Sys.getenv("PGPASS"),
-  sslmode = "require"
+  sslmode = "verify-full",
+  sslrootcert = bincraft::postgres_sslrootcert("verify-full")
 )
 # Scope the skip to the R minor this pass is running under. `single_builds`
 # records `r_version` per attempt, but querying without it made a non-primary
@@ -250,7 +251,7 @@ mapply(
       metadata_db_table = "single_builds",
       metadata_db_user = "rpkgs",
       metadata_db_password = Sys.getenv("PGPASS"),
-      metadata_db_sslmode = "require",
+      metadata_db_sslmode = "verify-full",
       metadata_db_port = 15432,
       archive = TRUE,
       patches = "local/patches",
diff --git a/local/build-newer-r.R b/local/build-newer-r.R
index 3d7794f..6478200 100644
--- a/local/build-newer-r.R
+++ b/local/build-newer-r.R
@@ -48,7 +48,7 @@ if ("--dry-run" %in% args) {
         metadata_db_name = "build_metadata",
         metadata_db_user = "rpkgs",
         metadata_db_password = Sys.getenv("PGPASS"),
-        metadata_db_sslmode = "require",
+        metadata_db_sslmode = "verify-full",
         metadata_db_port = 15432
       ),
       s3_endpoint = "https://s3.eu-central-003.backblazeb2.com",
@@ -61,7 +61,7 @@ if ("--dry-run" %in% args) {
       metadata_db_table = "single_builds",
       metadata_db_user = "rpkgs",
       metadata_db_password = Sys.getenv("PGPASS"),
-      metadata_db_sslmode = "require",
+      metadata_db_sslmode = "verify-full",
       metadata_db_port = 15432,
       archive = TRUE,
       patches = "local/patches",
diff --git a/local/build-one.R b/local/build-one.R
index 07c0b6a..25aae6e 100644
--- a/local/build-one.R
+++ b/local/build-one.R
@@ -115,7 +115,7 @@ for (ver in versions) {
     metadata_db_table = "single_builds",
     metadata_db_user = "rpkgs",
     metadata_db_password = Sys.getenv("PGPASS"),
-    metadata_db_sslmode = "require",
+    metadata_db_sslmode = "verify-full",
     metadata_db_port = 15432
   )
   if (sensitive) touched_minor <- TRUE else touched_generic <- TRUE
diff --git a/local/failing-builds-report.R b/local/failing-builds-report.R
index ce7b683..b9df756 100644
--- a/local/failing-builds-report.R
+++ b/local/failing-builds-report.R
@@ -69,7 +69,8 @@ con <- DBI::dbConnect(
   port = 15432,
   user = "rpkgs",
   password = Sys.getenv("PGPASS"),
-  sslmode = "require"
+  sslmode = "verify-full",
+  sslrootcert = bincraft::postgres_sslrootcert("verify-full")
 )
 on.exit(DBI::dbDisconnect(con), add = TRUE)
 
diff --git a/local/label-removed-cran-packages.R b/local/label-removed-cran-packages.R
index 12dff9d..a6ba36a 100644
--- a/local/label-removed-cran-packages.R
+++ b/local/label-removed-cran-packages.R
@@ -13,7 +13,8 @@ con <- DBI::dbConnect(
   port = 15432,
   user = "r_binaries",
   password = Sys.getenv("PGPASS"),
-  sslmode = "require"
+  sslmode = "verify-full",
+  sslrootcert = bincraft::postgres_sslrootcert("verify-full")
 )
 
 pkgs_db <- query_metadata_table() |>
diff --git a/local/list-unsafe-flat-objects.R b/local/list-unsafe-flat-objects.R
index 60649a2..fca0a9d 100644
--- a/local/list-unsafe-flat-objects.R
+++ b/local/list-unsafe-flat-objects.R
@@ -30,7 +30,8 @@ con <- DBI::dbConnect(
   port = 15432L,
   user = "rpkgs",
   password = Sys.getenv("PGPASS"),
-  sslmode = "require"
+  sslmode = "verify-full",
+  sslrootcert = bincraft::postgres_sslrootcert("verify-full")
 )
 on.exit(try(DBI::dbDisconnect(con), silent = TRUE), add = TRUE)
 
diff --git a/local/missing-cran-packages-db.R b/local/missing-cran-packages-db.R
index 882bca4..0c73e99 100644
--- a/local/missing-cran-packages-db.R
+++ b/local/missing-cran-packages-db.R
@@ -10,7 +10,8 @@ con <- DBI::dbConnect(
   port = 15432,
   user = "r_binaries",
   password = Sys.getenv("PGPASS"),
-  sslmode = "require"
+  sslmode = "verify-full",
+  sslrootcert = bincraft::postgres_sslrootcert("verify-full")
 )
 
 `%nin%` <- Negate(`%in%`)
@@ -45,12 +46,12 @@ data <- dbGetQuery(
   "SELECT name FROM single_builds WHERE platform = $1 AND arch = $2 and removed = FALSE;",
   params = list(platform, arch)
 )
-removed_pkgs = get_removed_cran_packages(lubridate::interval(
+removed_pkgs <- get_removed_cran_packages(lubridate::interval(
   lubridate::today(),
   lubridate::today() - 2
 ))$name
 pkgs_db <- unique(data$name)
-pkgs_db = setdiff(pkgs_db, removed_pkgs)
+pkgs_db <- setdiff(pkgs_db, removed_pkgs)
 
 pkgs <- setdiff(cran_pkgs, pkgs_db)
 formatted_pkgs <- gsub(
diff --git a/local/packages-to-build.R b/local/packages-to-build.R
index 31b667f..940cf83 100644
--- a/local/packages-to-build.R
+++ b/local/packages-to-build.R
@@ -32,7 +32,8 @@ con <- DBI::dbConnect(
   port = 15432,
   user = "rpkgs",
   password = Sys.getenv("PGPASS"),
-  sslmode = "require"
+  sslmode = "verify-full",
+  sslrootcert = bincraft::postgres_sslrootcert("verify-full")
 )
 
 cran_archive <- tools::CRAN_archive_db()
diff --git a/local/packages-without-any-binary.R b/local/packages-without-any-binary.R
index f42196f..870dc6e 100644
--- a/local/packages-without-any-binary.R
+++ b/local/packages-without-any-binary.R
@@ -8,7 +8,8 @@ con <- DBI::dbConnect(
   port = 15432,
   user = "r_binaries",
   password = Sys.getenv("PGPASS"),
-  sslmode = "require"
+  sslmode = "verify-full",
+  sslrootcert = bincraft::postgres_sslrootcert("verify-full")
 )
 
 cran_pkgs <- tools::CRAN_package_db() |>
@@ -27,7 +28,7 @@ pkgs <- data |>
   distinct(name) |>
   pull(name)
 
-pkgs = setdiff(cran_pkgs, pkgs)
+pkgs <- setdiff(cran_pkgs, pkgs)
 # Format, remove line breaks, and print as a single line
 formatted_pkgs <- gsub(
   '"',
diff --git a/local/proposal-tracking.R b/local/proposal-tracking.R
index f8e1284..82d0beb 100644
--- a/local/proposal-tracking.R
+++ b/local/proposal-tracking.R
@@ -53,7 +53,8 @@ con <- DBI::dbConnect(
   port = 15432,
   user = "rpkgs",
   password = Sys.getenv("PGPASS"),
-  sslmode = "require"
+  sslmode = "verify-full",
+  sslrootcert = bincraft::postgres_sslrootcert("verify-full")
 )
 on.exit(DBI::dbDisconnect(con), add = TRUE)
 
diff --git a/local/propose-patches.R b/local/propose-patches.R
index 360df9f..52a62b8 100644
--- a/local/propose-patches.R
+++ b/local/propose-patches.R
@@ -87,7 +87,8 @@ con <- DBI::dbConnect(
   port = 15432,
   user = "rpkgs",
   password = Sys.getenv("PGPASS"),
-  sslmode = "require"
+  sslmode = "verify-full",
+  sslrootcert = bincraft::postgres_sslrootcert("verify-full")
 )
 on.exit(DBI::dbDisconnect(con), add = TRUE)
 
diff --git a/local/prune-stale-flat-binaries.R b/local/prune-stale-flat-binaries.R
index aea97b4..a821d3f 100644
--- a/local/prune-stale-flat-binaries.R
+++ b/local/prune-stale-flat-binaries.R
@@ -86,7 +86,8 @@ if (length(explicit) > 0L) {
     port = 15432L,
     user = "rpkgs",
     password = Sys.getenv("PGPASS"),
-    sslmode = "require"
+    sslmode = "verify-full",
+    sslrootcert = bincraft::postgres_sslrootcert("verify-full")
   )
   on.exit(try(DBI::dbDisconnect(con), silent = TRUE), add = TRUE)
 
diff --git a/local/rebuild-missing.R b/local/rebuild-missing.R
index 369024e..5d518e0 100644
--- a/local/rebuild-missing.R
+++ b/local/rebuild-missing.R
@@ -171,7 +171,7 @@ for (i in seq_along(mine)) {
       metadata_db_table = "single_builds",
       metadata_db_user = "rpkgs",
       metadata_db_password = Sys.getenv("PGPASS"),
-      metadata_db_sslmode = "require",
+      metadata_db_sslmode = "verify-full",
       metadata_db_port = 15432,
       archive = TRUE,
       upload = TRUE,
diff --git a/local/repair-built-stamp.R b/local/repair-built-stamp.R
index 06f73be..65aeaa5 100644
--- a/local/repair-built-stamp.R
+++ b/local/repair-built-stamp.R
@@ -152,18 +152,44 @@ bincraft::upload_package_index(
   s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"),
   s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY")
 )
+# A per-minor index reads the ABI classifier cache and the flat-object safety
+# table from the build database. A failed minor does not stop the others, but
+# it does fail the run once they are done.
+failed_minors <- character(0L)
 for (minor in r_minors) {
-  try(
-    bincraft::upload_package_index(
-      codename = codename,
-      r_minor = minor,
-      s3_endpoint = endpoint,
-      s3_region = region,
-      s3_bucket = bucket,
-      s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"),
-      s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY")
-    ),
-    silent = FALSE
+  ok <- tryCatch(
+    {
+      bincraft::upload_package_index(
+        codename = codename,
+        r_minor = minor,
+        s3_endpoint = endpoint,
+        s3_region = region,
+        s3_bucket = bucket,
+        s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"),
+        s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"),
+        metadata_db_host = "r-binaries.devxy.io",
+        metadata_db_name = "build_metadata",
+        metadata_db_port = 15432L,
+        metadata_db_user = "rpkgs",
+        metadata_db_password = Sys.getenv("PGPASS"),
+        metadata_db_sslmode = "verify-full"
+      )
+      TRUE
+    },
+    error = function(e) {
+      message(sprintf("Re-indexing %s failed: %s", minor, conditionMessage(e)))
+      FALSE
+    }
+  )
+  if (!ok) {
+    failed_minors <- c(failed_minors, minor)
+  }
+}
+if (length(failed_minors) > 0L) {
+  stop(
+    "Could not republish the per-minor index for: ",
+    paste(failed_minors, collapse = ", "),
+    call. = FALSE
   )
 }
 
diff --git a/local/weekly-missing-binaries-audit.R b/local/weekly-missing-binaries-audit.R
index e7ca776..c999e37 100644
--- a/local/weekly-missing-binaries-audit.R
+++ b/local/weekly-missing-binaries-audit.R
@@ -60,7 +60,8 @@ con <- DBI::dbConnect(
   port = 15432,
   user = "rpkgs",
   password = Sys.getenv("PGPASS"),
-  sslmode = "require"
+  sslmode = "verify-full",
+  sslrootcert = bincraft::postgres_sslrootcert("verify-full")
 )
 
 errored_pkgs <- DBI::dbGetQuery(