diff --git a/samples/web-app-sql-database/python/scripts/deploy.sh b/samples/web-app-sql-database/python/scripts/deploy.sh
index eed9ec0..58d66a5 100755
--- a/samples/web-app-sql-database/python/scripts/deploy.sh
+++ b/samples/web-app-sql-database/python/scripts/deploy.sh
@@ -360,7 +360,7 @@ else
 fi
 
 # Build connection string
-SQL_CONNECTION_STRING="Server=tcp:${SQL_SERVER_FQDN},1433;Database=${SQL_DATABASE_NAME};User ID=${DATABASE_USER_NAME};Password=${DATABASE_USER_PASSWORD};Encrypt=yes;TrustServerCertificate=yes;Connection Timeout=30;"
+SQL_CONNECTION_STRING="Server=tcp:${SQL_SERVER_FQDN},1433;Database=${SQL_DATABASE_NAME};User ID=${DATABASE_USER_NAME};Password=${DATABASE_USER_PASSWORD};Encrypt=yes;Connection Timeout=30;"
 
 # Create secret
 echo "Creating secret [$SECRET_NAME] in Key Vault..."
diff --git a/samples/web-app-sql-database/python/src/database.py b/samples/web-app-sql-database/python/src/database.py
index cd3d3d6..8c2cc7f 100644
--- a/samples/web-app-sql-database/python/src/database.py
+++ b/samples/web-app-sql-database/python/src/database.py
@@ -166,15 +166,17 @@ def _build_connection_string(self) -> str:
             f"Server=tcp:{self.server},1433;"
             f"Database={self.database};"
             f"Encrypt=yes;"
-            f"TrustServerCertificate=yes;"
             f"Connection Timeout={self.connection_timeout};"
         )
         
-        # TrustServerCertificate=yes tells the ODBC driver to accept self-signed certificates without verification
-        # This is appropriate for:
-        # - Local development with Docker containers
-        # - Testing environments with self-signed certificates
-        # - Internal networks where you control the SQL Server
+        # TrustServerCertificate is deliberately absent: its default is already "no" in ODBC Driver 18,
+        # so the driver validates the server certificate, which is what Microsoft recommends
+        # (https://learn.microsoft.com/sql/connect/odbc/major-version-differences#encryption-changes).
+        # That works against Azure SQL Database and against LocalStack for Azure alike, because the
+        # emulator serves a publicly trusted certificate for the host name it returns in
+        # fullyQualifiedDomainName. Add TrustServerCertificate=yes only if LocalStack could not
+        # download that certificate (for example with SKIP_SSL_CERT_DOWNLOAD=1), in which case the
+        # server presents a certificate issued by the LocalStack root certificate authority.
 
         if not self.use_azure_credential:
             # Traditional SQL authentication