diff --git a/portainer-automation/src/main/java/com/hithomelabs/portainer/config/PortainerClientConfig.java b/portainer-automation/src/main/java/com/hithomelabs/portainer/config/PortainerClientConfig.java
index a1eb364..6d98a75 100644
--- a/portainer-automation/src/main/java/com/hithomelabs/portainer/config/PortainerClientConfig.java
+++ b/portainer-automation/src/main/java/com/hithomelabs/portainer/config/PortainerClientConfig.java
@@ -22,12 +22,11 @@ import java.security.cert.X509Certificate;
 public class PortainerClientConfig {
 
     /**
-     * Trust-all SSL RestTemplate for the "local" profile.
-     * Used when connecting via Cloudflare Tunnel (self-signed certs).
+     * Builds a RestTemplate that trusts all SSL certificates.
+     * Used when connecting via Cloudflare Tunnel (self-signed certs)
+     * or to the prod Portainer instance (also self-signed).
      */
-    @Profile("local")
-    @Bean(name = "portainerRestTemplate")
-    public RestTemplate portainerRestTemplateLocal() throws Exception {
+    private static RestTemplate buildTrustAllRestTemplate() throws Exception {
         TrustManager[] trustAllCerts = new TrustManager[]{
                 new X509TrustManager() {
                     public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
@@ -47,12 +46,32 @@ public class PortainerClientConfig {
     }
 
     /**
-     * Standard validating SSL RestTemplate for non-local profiles
-     * (CI, test, prod — internal Docker network).
+     * Trust-all SSL RestTemplate for the "local" profile.
+     * Used when connecting via Cloudflare Tunnel (self-signed certs).
      */
-    @Profile("!local")
+    @Profile("local")
     @Bean(name = "portainerRestTemplate")
-    public RestTemplate portainerRestTemplate() {
+    public RestTemplate portainerRestTemplateLocal() throws Exception {
+        return buildTrustAllRestTemplate();
+    }
+
+    /**
+     * Trust-all SSL RestTemplate for the "prod" profile.
+     * Prod Portainer at https://192.168.0.100:9443 uses a self-signed certificate.
+     */
+    @Profile("prod")
+    @Bean(name = "portainerRestTemplate")
+    public RestTemplate portainerRestTemplateProd() throws Exception {
+        return buildTrustAllRestTemplate();
+    }
+
+    /**
+     * Standard validating SSL RestTemplate for profiles other than local and prod
+     * (CI, test — internal Docker network with valid certs).
+     */
+    @Profile("!local & !prod")
+    @Bean(name = "portainerRestTemplate")
+    public RestTemplate portainerRestTemplateDefault() {
         return new RestTemplate();
     }