diff --git a/backend/config/default.cjs b/backend/config/default.cjs
index 0a7168e5a..d551de699 100644
--- a/backend/config/default.cjs
+++ b/backend/config/default.cjs
@@ -20,9 +20,16 @@ module.exports = {
   },
 
   mongo: {
-    // A mongo connection URI, can contain usernames, passwords, replica set information, etc.
+    // A mongo connection URI, can contain replica set information, etc.
     // See: https://www.mongodb.com/docs/manual/reference/connection-string/
+
+    // This is usually embedded in a config map, so do not put usernames and
+    // passwords in the connection string.
     uri: 'mongodb://localhost:27017/bailo?directConnection=true',
+
+    // Authentication details
+    user: undefined,
+    pass: undefined,
   },
 
   registry: {
diff --git a/backend/src/utils/config.ts b/backend/src/utils/config.ts
index 8cf483027..3bd132f58 100644
--- a/backend/src/utils/config.ts
+++ b/backend/src/utils/config.ts
@@ -82,6 +82,9 @@ export interface Config {
 
   mongo: {
     uri: string
+
+    user: string
+    pass: string
   }
 
   registry: {
diff --git a/backend/src/utils/database.ts b/backend/src/utils/database.ts
index 4c0aa5b61..67afb696c 100644
--- a/backend/src/utils/database.ts
+++ b/backend/src/utils/database.ts
@@ -16,7 +16,10 @@ export async function connectToMongoose() {
   try {
     mongoose.set('strictQuery', false)
     mongoose.set('strictPopulate', false)
-    await mongoose.connect(config.mongo.uri)
+    await mongoose.connect(config.mongo.uri, {
+      user: config.mongo.user,
+      pass: config.mongo.pass,
+    })
     log.info('Connected to Mongoose')
   } catch (error) {
     log.error({ error }, 'Error')