diff --git a/.gitea/workflows/terraform.yml b/.gitea/workflows/terraform.yml
index a041aa2..287f3a6 100644
--- a/.gitea/workflows/terraform.yml
+++ b/.gitea/workflows/terraform.yml
@@ -4,7 +4,9 @@ name: Terraform Terragrunt (contour)
 # repository variables/secrets in each contour's Gitea — this is the downstream
 # runner contract:
 #   vars:    INFRA_ENV, RUNNER_LABEL, RUNNER_IMAGE, RABBITMQ_ENDPOINT, PG_ADMIN_HOST,
-#            KAFKA_BOOTSTRAP, SKIP_POSTGRES_ADMIN, SKIP_KAFKA_ADMIN, SKIP_MINIO_ADMIN
+#            PG_ADMIN_PORT, PG_ADMIN_USER, KAFKA_BOOTSTRAP, KAFKA_TLS_ENABLED,
+#            KAFKA_SASL_MECHANISM, KAFKA_CA_CERT, SKIP_POSTGRES_ADMIN,
+#            SKIP_KAFKA_ADMIN, SKIP_MINIO_ADMIN
 #   secrets: TF_STATE_S3_ENDPOINT, TF_STATE_S3_BUCKET, S3_ACCESS_KEY, S3_SECRET_KEY,
 #            VAULT_ADDR, VAULT_TOKEN, SOPS_AGE_KEY_CONTOUR, KUBECONFIG_B64 (external
 #            runner only), KUBE_CONTEXT (external runner only), GITLAB_MODULE_TOKEN
@@ -42,7 +44,12 @@ env:
   SKIP_KAFKA_ADMIN: ${{ vars.SKIP_KAFKA_ADMIN }}
   SKIP_MINIO_ADMIN: ${{ vars.SKIP_MINIO_ADMIN }}
   PG_ADMIN_HOST: ${{ vars.PG_ADMIN_HOST }}
+  PG_ADMIN_PORT: ${{ vars.PG_ADMIN_PORT }}
+  PG_ADMIN_USER: ${{ vars.PG_ADMIN_USER }}
   KAFKA_BOOTSTRAP: ${{ vars.KAFKA_BOOTSTRAP }}
+  KAFKA_TLS_ENABLED: ${{ vars.KAFKA_TLS_ENABLED }}
+  KAFKA_SASL_MECHANISM: ${{ vars.KAFKA_SASL_MECHANISM }}
+  KAFKA_CA_CERT: ${{ vars.KAFKA_CA_CERT }}
   RABBITMQ_ENDPOINT: ${{ vars.RABBITMQ_ENDPOINT }}
   # Bootstrap escape hatch (see scripts/run_all_stacks.sh) - normally unset;
   # set temporarily to a space-separated stack subset (e.g. "namespace