diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 3bf97f0d99..5ee5e38328 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-62a462461271b900351c18b0ab1ca78651154b2a
+bcfb663f9e902539abbbf69c517715eb8d4ce8f9
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 85357437a0..2a151d966c 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -19904,6 +19904,9 @@ components:
         token:
           type: string
           description: Static Vault token for testing/development (optional, if provided this is used instead of JWT authentication)
+        skip_ssl_verify:
+          type: boolean
+          description: Skip TLS certificate verification when connecting to Vault. Only use for self-signed certificates in development environments.
 
     AzureKeyVaultSettings:
       type: object
diff --git a/backend/windmill-common/src/secret_backend/mod.rs b/backend/windmill-common/src/secret_backend/mod.rs
index 2e0d6d0f21..8caaed6012 100644
--- a/backend/windmill-common/src/secret_backend/mod.rs
+++ b/backend/windmill-common/src/secret_backend/mod.rs
@@ -129,6 +129,10 @@ pub struct VaultSettings {
     /// If provided, this is used instead of JWT authentication
     #[serde(skip_serializing_if = "Option::is_none")]
     pub token: Option<String>,
+    /// Skip TLS certificate verification when connecting to Vault
+    /// Only use for self-signed certificates in development environments
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skip_ssl_verify: Option<bool>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
diff --git a/backend/windmill-common/src/secret_backend/tests.rs b/backend/windmill-common/src/secret_backend/tests.rs
index 2a6962f8dd..630b6cf023 100644
--- a/backend/windmill-common/src/secret_backend/tests.rs
+++ b/backend/windmill-common/src/secret_backend/tests.rs
@@ -28,6 +28,7 @@ mod tests {
             jwt_role: Some("windmill-secrets".to_string()),
             namespace: None,
             token: Some("test-root-token".to_string()),
+            skip_ssl_verify: None,
         }
     }
 
diff --git a/backend/windmill-common/tests/secret_backend_integration.rs b/backend/windmill-common/tests/secret_backend_integration.rs
index 817a8d0e65..542dba12b4 100644
--- a/backend/windmill-common/tests/secret_backend_integration.rs
+++ b/backend/windmill-common/tests/secret_backend_integration.rs
@@ -96,6 +96,7 @@ mod tests {
             token: Some(
                 std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string()),
             ),
+            skip_ssl_verify: None,
         }
     }
 
@@ -108,6 +109,7 @@ mod tests {
             jwt_role: Some("windmill-secrets".to_string()), // JWT mode
             namespace: None,
             token: None, // No static token - use JWT
+            skip_ssl_verify: None,
         }
     }
 
diff --git a/backend/windmill-common/tests/secret_backend_migration.rs b/backend/windmill-common/tests/secret_backend_migration.rs
index baa2940319..1915b90630 100644
--- a/backend/windmill-common/tests/secret_backend_migration.rs
+++ b/backend/windmill-common/tests/secret_backend_migration.rs
@@ -36,6 +36,7 @@ fn test_vault_settings() -> VaultSettings {
         token: Some(
             std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string()),
         ),
+        skip_ssl_verify: None,
     }
 }
 
diff --git a/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte b/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte
index 8e33b75300..c2ebc581aa 100644
--- a/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte
+++ b/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte
@@ -4,6 +4,7 @@
 	import { SettingService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import TextInput from '../text_input/TextInput.svelte'
+	import Toggle from '../Toggle.svelte'
 	import { Database, Lock, Server, ArrowLeft, ArrowRight, Cloud } from 'lucide-svelte'
 	import type { Writable } from 'svelte/store'
 	import { enterpriseLicense } from '$lib/stores'
@@ -67,7 +68,8 @@
 				mount_path: $values['secret_backend']?.mount_path ?? 'windmill',
 				jwt_role: $values['secret_backend']?.jwt_role ?? 'windmill-secrets',
 				namespace: $values['secret_backend']?.namespace ?? null,
-				token: $values['secret_backend']?.token ?? null
+				token: $values['secret_backend']?.token ?? null,
+				skip_ssl_verify: $values['secret_backend']?.skip_ssl_verify ?? false
 			}
 		} else if (type === 'AzureKeyVault') {
 			$values['secret_backend'] = {
@@ -105,7 +107,8 @@
 			mount_path: $values['secret_backend'].mount_path,
 			jwt_role: $values['secret_backend'].jwt_role,
 			namespace: $values['secret_backend'].namespace || undefined,
-			token: $values['secret_backend'].token || undefined
+			token: $values['secret_backend'].token || undefined,
+			skip_ssl_verify: $values['secret_backend'].skip_ssl_verify || undefined
 		}
 	}
 
@@ -357,6 +360,10 @@ vault write auth/jwt/role/windmill-secrets \
 					<span class="text-2xs text-secondary">Vault Enterprise namespace</span>
 					<TextInput inputProps={{ type: 'text', id: 'vault_namespace', placeholder: 'admin/my-namespace', disabled }} bind:value={$values['secret_backend'].namespace} />
 				</div>
+				<div class="flex flex-col gap-1">
+					<Toggle id="vault_skip_ssl_verify" {disabled} bind:checked={$values['secret_backend'].skip_ssl_verify} size="xs" options={{ right: 'Skip TLS certificate verification' }} />
+					<span class="text-2xs text-secondary">Disables TLS verification when connecting to Vault. Only enable for self-signed certificates in development.</span>
+				</div>
 			</div>
 			<div class="flex flex-col gap-4 pt-4 border-t">
 				<Button unifiedSize="md" variant="accent" onclick={testVaultConnection} disabled={disabled || !isVaultConfigValid() || testingConnection} loading={testingConnection} startIcon={{ icon: Server }}>Test Connection</Button>