diff --git a/ucepsa/edge-oee-demo/services/edge-oee-mqtt-pg-sink/main.py b/ucepsa/edge-oee-demo/services/edge-oee-mqtt-pg-sink/main.py
index 1854408..b7895b3 100644
--- a/ucepsa/edge-oee-demo/services/edge-oee-mqtt-pg-sink/main.py
+++ b/ucepsa/edge-oee-demo/services/edge-oee-mqtt-pg-sink/main.py
@@ -33,6 +33,8 @@ def getenv(name, default=None, required=False):
 MQTT_HOST = getenv("MQTT_HOST", required=True)
 MQTT_PORT = int(getenv("MQTT_PORT", "1883"))
 MQTT_TOPIC = getenv("MQTT_TOPIC", required=True)
+MQTT_USER = getenv("MQTT_USER")
+MQTT_PASSWORD = getenv("MQTT_PASSWORD")
 
 PGHOST = getenv("PGHOST", required=True)
 PGPORT = int(getenv("PGPORT", "5432"))
@@ -502,6 +504,13 @@ def main():
     print(f"[CONFIG] PostgreSQL {PGHOST}:{PGPORT}/{PGDATABASE} user={PGUSER}")
 
     client = mqtt.Client(mqtt.CallbackAPIVersion.VERSION2)
+
+    if MQTT_USER:
+        client.username_pw_set(MQTT_USER, MQTT_PASSWORD)
+        print(f"[CONFIG] MQTT auth user={MQTT_USER}", flush=True)
+    else:
+        print("[WARN] MQTT auth disabled: MQTT_USER not set", flush=True)
+
     client.on_connect = on_connect
     client.on_message = on_message