diff --git a/samples/demo/README.md b/samples/demo/README.md
index c804268c..5a5feab8 100644
--- a/samples/demo/README.md
+++ b/samples/demo/README.md
@@ -14,3 +14,9 @@ docker build \
   --tag radius-demo:local \
   samples/demo
 ```
+
+## PostgreSQL variant
+
+`app-postgresql.bicep` uses the Kubernetes Container Recipe's direct Secret connection support to project the database password as `CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD`. This requires Radius 0.61.0 or later, or a current edge installation.
+
+The demo image prefers that variable and retains `CONNECTION_POSTGRESQL_PASSWORD` as a compatibility fallback for older or mixed installations whose PostgreSQL Recipe still supplies the password. If both variables are set to different values, the demo logs a warning and uses `CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD`. Azure ACI does not project direct Secret connections, so this new password path is Kubernetes-only; its existing connection behavior is unchanged.
diff --git a/samples/demo/app-postgresql.bicep b/samples/demo/app-postgresql.bicep
index 98a29c18..868e2846 100644
--- a/samples/demo/app-postgresql.bicep
+++ b/samples/demo/app-postgresql.bicep
@@ -37,6 +37,9 @@ resource demoContainer 'Radius.Compute/containers@2025-08-01-preview' = {
       postgresql: {
         source: postgresql.id
       }
+      postgresqlCredentials: {
+        source: postgresqlCredentials.id
+      }
     }
   }
 }
@@ -52,3 +55,16 @@ resource postgresql 'Radius.Data/postgreSqlDatabases@2025-08-01-preview' = {
     password: password
   }
 }
+
+resource postgresqlCredentials 'Radius.Security/secrets@2025-08-01-preview' = {
+  name: 'postgresql-credentials-${environmentName}'
+  properties: {
+    environment: environment
+    application: demoApp.id
+    data: {
+      password: {
+        value: password
+      }
+    }
+  }
+}
diff --git a/samples/demo/src/db/repository.ts b/samples/demo/src/db/repository.ts
index 6342566f..f53c01dd 100644
--- a/samples/demo/src/db/repository.ts
+++ b/samples/demo/src/db/repository.ts
@@ -66,11 +66,19 @@ export function createFactory(): RepositoryFactory {
 
     if (process.env.CONNECTION_POSTGRESQL_HOST) {
         console.log("Using PostgreSQL: found hostname in environment variable CONNECTION_POSTGRESQL_HOST");
+        const secretConnectionPassword = process.env.CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD || undefined;
+        const legacyConnectionPassword = process.env.CONNECTION_POSTGRESQL_PASSWORD || undefined;
+        if (secretConnectionPassword &&
+            legacyConnectionPassword &&
+            secretConnectionPassword !== legacyConnectionPassword) {
+            console.warn("Conflicting PostgreSQL passwords found; using CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD instead of CONNECTION_POSTGRESQL_PASSWORD");
+        }
+
         const connection = {
             host: process.env.CONNECTION_POSTGRESQL_HOST!,
             port: process.env.CONNECTION_POSTGRESQL_PORT!,
             username: process.env.CONNECTION_POSTGRESQL_USERNAME || '',
-            password: process.env.CONNECTION_POSTGRESQL_PASSWORD || '',
+            password: secretConnectionPassword || legacyConnectionPassword || '',
             database: process.env.CONNECTION_POSTGRESQL_DATABASE || '',
         }
         const url = `postgresql://${connection.username}:${connection.password}@${connection.host}:${connection.port}/${connection.database}`