diff --git a/src/aare/daq/tellupdater.py b/src/aare/daq/tellupdater.py
index 6c21f535..13bf63af 100644
--- a/src/aare/daq/tellupdater.py
+++ b/src/aare/daq/tellupdater.py
@@ -38,12 +38,25 @@ def listen_to_sse():
         print(f"[SSE][WARN] No TELL URL configured – SSE listener not started. (tell_client.url={tell_client.url})")
         return
     sse_url = tell_client.url + "/events"
-    
+
     while True:
         try:
             print(f"[SSE][INFO] Attempting to connect to {sse_url}...")
-            # Use URL directly for sseclient variants that manage their own HTTP stream.
-            client = sseclient.SSEClient(sse_url)
+
+            # --- MANDATORY mTLS FOR mx-db-01 ---
+            import requests
+            cert_pair = (
+                "/etc/ssl/certs/secrets/mx-x10sa-queue-01.crt",
+                "/etc/ssl/certs/secrets/mx-x10sa-queue-01.key"
+            )
+            # The DigiCert root you have on the machine
+            ca_root = "/etc/ssl/certs/secrets/mx-db-01_DigiCert_Global_Root_G2.pem"
+
+            # Open the stream using the certificates required by Nginx
+            response = requests.get(sse_url, stream=True, cert=cert_pair, verify=ca_root)
+            response.raise_for_status()
+
+            client = sseclient.SSEClient(response)
 
             print("[SSE][listen_to_sse] Initial detected pucks fetch on connect")
             handle_tell_change_event()