diff --git a/roles/koji_hub/files/koji-sign-spooler b/roles/koji_hub/files/koji-sign-spooler
index 19e58d0..f78f9f2 100644
--- a/roles/koji_hub/files/koji-sign-spooler
+++ b/roles/koji_hub/files/koji-sign-spooler
@@ -125,7 +125,7 @@ def process_queue():
     kojihub.db.setDBopts(**db_opts)
 
     try:
-        kojihub.db.connect()
+        kojihub.context.cnx = kojihub.db.connect()
     except Exception as e:
         logger.error(f"Failed to connect to Koji Hub DB: {e}")
         return
diff --git a/roles/koji_hub/tasks/main.yaml b/roles/koji_hub/tasks/main.yaml
index 70bcd66..99e5282 100644
--- a/roles/koji_hub/tasks/main.yaml
+++ b/roles/koji_hub/tasks/main.yaml
@@ -155,8 +155,7 @@
     - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateFile", line: "SSLCertificateFile {{ koji_hub_cert_path }}" }
     - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateKeyFile", line: "SSLCertificateKeyFile {{ koji_hub_key_path }}" }
     - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLCACertificateFile", line: "SSLCACertificateFile {{ koji_remote_ca_trust_path }}" }
-    - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyClient", line: "SSLVerifyClient {{ koji_hub_ssl_verify_client }}" }
-    - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyDepth", line: "SSLVerifyDepth 10" }
+    - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLProtocol", line: "SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.3" }
   notify: Restart httpd
 
 - name: Enable SSL for Koji Hub
diff --git a/vars/default.yaml b/vars/default.yaml
index b040116..7f9e5bb 100644
--- a/vars/default.yaml
+++ b/vars/default.yaml
@@ -102,11 +102,6 @@ kojid_mock_root: /var/lib/mock/mxos0-build-x86_64
 
 # HTTPD/Web Paths
 koji_hub_httpd_ssl_config_file: /etc/httpd/conf.d/ssl.conf
-# WARNING: Set to "require" in production for security. "optional" is used in
-# development/staging to avoid TLS 1.3 Post-Handshake Authentication (PHA)
-# browser errors (like "Cannot perform Post-Handshake Authentication") when
-# logging in to Koji Web (which enforces client certificate validation).
-koji_hub_ssl_verify_client: optional
 koji_cleanup_script_path: /usr/local/bin/koji_cleanup.sh
 koji_cleanup_service_path: /etc/systemd/system/koji-cleanup.service
 koji_cleanup_timer_path: /etc/systemd/system/koji-cleanup.timer