diff --git a/README.md b/README.md
index 7c510a9f..1bbd17bf 100644
--- a/README.md
+++ b/README.md
@@ -32,10 +32,11 @@ In order to run the dex-explorer, you'll need to [deploy a Penumbra fullnode](ht
 with [ABCI event indexing enabled](https://guide.penumbra.zone/node/pd/indexing-events). The relevant env vars
 you'll want to set are:
 
-  * `PENUMBRA_GRPC_ENDPOINT`
-  * `PENUMBRA_INDEXER_ENDPOINT`
-  * `NEXT_PUBLIC_CHAIN_ID`
-  * `NEXT_PUBLIC_CUILOA_URL`
+  * `PENUMBRA_GRPC_ENDPOINT`: the URL to a remote node's `pd` gRPC service
+  * `PENUMBRA_INDEXER_ENDPOINT`: the URL to a Postgre database containing ABCI events
+  * `PENUMBRA_INDEXER_CA_CERT`: optional; if set, the database connection will use the provided certificate authority when validating TLS
+  * `NEXT_PUBLIC_CHAIN_ID`: the chain id for the network being indexed, controls asset-registry lookups
+  * `NEXT_PUBLIC_CUILOA_URL`: the URL for a block-explorer application, for generating URLs for more block/transaction info
 
 ## Name
 
diff --git a/justfile b/justfile
new file mode 100644
index 00000000..688ba129
--- /dev/null
+++ b/justfile
@@ -0,0 +1,6 @@
+# A justfile for dex-explorer development.
+# Documents common tasks for local dev.
+
+# build container image
+container:
+  podman build -f Containerfile .
diff --git a/src/utils/indexer/connector.tsx b/src/utils/indexer/connector.tsx
index e7b86274..52f53226 100644
--- a/src/utils/indexer/connector.tsx
+++ b/src/utils/indexer/connector.tsx
@@ -8,7 +8,20 @@ export class IndexerQuerier {
   private pool: Pool;
 
   constructor(connectionString: string) {
-    this.pool = new Pool({ connectionString });
+    const dbConfig = {
+      connectionString: connectionString,
+      // If a CA certificate was specified as an env var, pass that info to the database config.
+      // Be advised that if PENUMBRA_INDEXER_CA_CERT is set, then PENUMBRA_INDEXER_ENDPOINT must
+      // *lack* an `sslmode` param! This is documented here:
+      // https://node-postgres.com/features/ssl#usage-with-connectionstring
+      ...(process.env.PENUMBRA_INDEXER_CA_CERT != null && {
+        ssl: {
+            rejectUnauthorized: true,
+            ca: process.env.PENUMBRA_INDEXER_CA_CERT,
+          },
+      }),
+    };
+    this.pool = new Pool(dbConfig);
   }
 
   /**