diff --git a/config/runtime.exs b/config/runtime.exs
index 54e9e61c..1fe02a66 100644
--- a/config/runtime.exs
+++ b/config/runtime.exs
@@ -307,9 +307,13 @@ if config_env() == :prod do
     ssl: ssl_config,
     url: database_url,
     pool_size: String.to_integer(System.get_env("POOL_SIZE") || "20"),
-    # For machines with several cores, consider starting multiple pools of `pool_size`
-    # pool_count: 4,
-    socket_options: maybe_ipv6
+    # Detect stale connections faster: if a query takes longer than queue_target (2s)
+    # on average over queue_interval (5s), DBConnection will disconnect idle connections
+    # to cycle in fresh ones. Helps recover from "ssl recv: closed" errors.
+    queue_target: 2_000,
+    queue_interval: 5_000,
+    # TCP keepalive prevents proxies/firewalls from dropping idle connections
+    socket_options: maybe_ipv6 ++ [keepalive: true]
 
   config :towerops, Towerops.Vault,
     ciphers: [