diff --git a/apps/pangolin/pangolin-config.yaml b/apps/pangolin/pangolin-config.yaml
index 94293c8..11dd954 100644
--- a/apps/pangolin/pangolin-config.yaml
+++ b/apps/pangolin/pangolin-config.yaml
@@ -1,12 +1,15 @@
 ---
 # Pangolin ConfigMap
+# The `postgres.connection_string` placeholder is replaced at pod startup
+# by the render-config init container using DATABASE_URL from the sealed
+# secret. See pangolin-deployment.yaml.
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: pangolin-config
   namespace: pangolin
 data:
-  config.yml: |
+  config.yml.tmpl: |
     gerbil:
       start_port: 10000
       base_endpoint: "pangolin.basicstack.de"
@@ -29,6 +32,9 @@ data:
       signup: true
       verification: false
 
+    postgres:
+      connection_string: "__DATABASE_URL__"
+
     oidc:
       enabled: true
       issuer: "https://auth.basicstack.de"
diff --git a/apps/pangolin/pangolin-deployment.yaml b/apps/pangolin/pangolin-deployment.yaml
index bbb042b..2e51616 100644
--- a/apps/pangolin/pangolin-deployment.yaml
+++ b/apps/pangolin/pangolin-deployment.yaml
@@ -57,6 +57,29 @@ spec:
             secretKeyRef:
               name: pangolin-postgres-secrets
               key: postgres-db
+      - name: render-config
+        image: busybox:1.37
+        command:
+        - /bin/sh
+        - -c
+        - |
+          set -e
+          # Escape sed replacement metacharacters in the connection string
+          esc=$(printf '%s' "$DATABASE_URL" | sed -e 's/[\/&|]/\\&/g')
+          sed "s|__DATABASE_URL__|$esc|" /tmpl/config.yml.tmpl > /rendered/config.yml
+          echo "rendered config.yml (secrets redacted):"
+          sed 's|connection_string:.*|connection_string: <redacted>|' /rendered/config.yml
+        env:
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: pangolin-postgres-secrets
+              key: connection-string
+        volumeMounts:
+        - name: config-tmpl
+          mountPath: /tmpl
+        - name: config-rendered
+          mountPath: /rendered
       containers:
       - name: pangolin
         image: fosrl/pangolin:postgresql-1.21.1
@@ -68,7 +91,6 @@ spec:
         env:
         - name: PANGOLIN_URL
           value: "https://pangolin.basicstack.de"
-        # PostgreSQL database URL (Pangolin PostgreSQL variant reads this at startup)
         - name: DATABASE_URL
           valueFrom:
             secretKeyRef:
@@ -102,7 +124,7 @@ spec:
         volumeMounts:
         - name: pangolin-data
           mountPath: /app/config
-        - name: config
+        - name: config-rendered
           mountPath: /app/config/config.yml
           subPath: config.yml
         resources:
@@ -132,9 +154,11 @@ spec:
       - name: pangolin-data
         persistentVolumeClaim:
           claimName: pangolin-data
-      - name: config
+      - name: config-tmpl
         configMap:
           name: pangolin-config
+      - name: config-rendered
+        emptyDir: {}
 ---
 # Pangolin Service
 apiVersion: v1