diff --git a/src/config/__tests__/toml-loader.test.ts b/src/config/__tests__/toml-loader.test.ts
index 344bc399..3949ae17 100644
--- a/src/config/__tests__/toml-loader.test.ts
+++ b/src/config/__tests__/toml-loader.test.ts
@@ -29,6 +29,7 @@ describe('TOML Configuration Tests', () => {
       // Ignore cleanup errors
     }
     process.argv = originalArgv;
+    vi.unstubAllEnvs();
   });
 
   describe('loadTomlConfig', () => {
@@ -562,6 +563,22 @@ sslmode = "invalid"
         expect(() => loadTomlConfig()).toThrow("invalid sslmode 'invalid'");
       });
 
+      it.each([
+        ['literal', '', 'disable'],
+        ['environment', '${TEST_SSLMODE}', 'require'],
+      ])('should reject an empty %s sslmode before DSN fallback', (_name, sslmode, dsnSslmode) => {
+        vi.stubEnv('TEST_SSLMODE', '');
+        const tomlContent = `
+[[sources]]
+id = "test_db"
+dsn = "postgres://fakeuser:fakepass@localhost:5432/testdb?sslmode=${dsnSslmode}"
+sslmode = "${sslmode}"
+`;
+        fs.writeFileSync(path.join(tempDir, 'dbhub.toml'), tomlContent);
+
+        expect(() => loadTomlConfig()).toThrow("invalid sslmode ''");
+      });
+
       it('should throw error when DSN sslmode conflicts with sslmode field', () => {
         const tomlContent = `
 [[sources]]
diff --git a/src/config/toml-loader.ts b/src/config/toml-loader.ts
index 8d285c49..b719a6d7 100644
--- a/src/config/toml-loader.ts
+++ b/src/config/toml-loader.ts
@@ -899,7 +899,7 @@ function processSourceConfigs(
       try {
         const url = new SafeURL(processed.dsn);
         const dsnSslmode = url.getSearchParam("sslmode");
-        if (!processed.sslmode && dsnSslmode) {
+        if (processed.sslmode === undefined && dsnSslmode) {
           processed.sslmode = dsnSslmode as SourceConfig["sslmode"];
         }
         for (const field of ["sslrootcert", "sslcert", "sslkey"] as const) {