diff --git a/README.md b/README.md
index facfb02..0d9db53 100644
--- a/README.md
+++ b/README.md
@@ -14,19 +14,19 @@ datastore trio (`redis` / `psql` / `mysql`), a sibling of the `mongo` lib.
 `requirements.txt`:
 
 ```
-redis_store @ git+ssh://git@git.rethinkstudios.io/rethink-public/redis.git@v0.1.2
+redis_store @ git+ssh://git@git.rethinkstudios.io/rethink-public/redis.git@v0.1.3
 ```
 
 Direct:
 
 ```bash
-pip install "redis_store @ git+ssh://git@git.rethinkstudios.io/rethink-public/redis.git@v0.1.2"
+pip install "redis_store @ git+ssh://git@git.rethinkstudios.io/rethink-public/redis.git@v0.1.3"
 ```
 
 Pulls `redis>=5` (redis-py, which ships the asyncio client — **not** the dead standalone
 `aioredis`).
 
-Drop the `@v0.1.2` suffix from the line above to install the latest unpinned.
+Drop the `@v0.1.3` suffix from the line above to install the latest unpinned.
 
 ## Usage
 
@@ -66,6 +66,11 @@ Pool sizing/timeout are `max_connections=` and `pool_timeout=` (how long a calle
 a free connection when the pool is saturated). Pass the driver's own `timeout=` in
 `pool_kwargs` and construction raises a clear `ValueError` — use `pool_timeout=`.
 
+`ssl=True` maps to `connection_class=redis.asyncio.SSLConnection`, so TLS works via the
+documented `pool_kwargs` path (the default connection class has no `ssl` parameter and
+would otherwise defer a `TypeError` to `connect()`). Pass ssl-prefixed kwargs alongside
+it (`ssl_ca_certs`, `ssl_certfile`, ...) to configure the handshake.
+
 ## Error contract — fail loud
 
 Unlike the `mongo` lib (which log-and-swallows, returning a safe default), **this lib
diff --git a/pyproject.toml b/pyproject.toml
index 4c7c851..c4af4ee 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "redis_store"
-version = "0.1.2"
+version = "0.1.3"
 description = "async redis wrapper over redis-py asyncio with a raw escape hatch, fail-loud and config-free"
 requires-python = ">=3.10"
 dependencies = [
diff --git a/src/redis_store/redis_store.py b/src/redis_store/redis_store.py
index c892bfc..0fc2f6d 100644
--- a/src/redis_store/redis_store.py
+++ b/src/redis_store/redis_store.py
@@ -34,6 +34,9 @@ notes:
     - import is `redis_store`; the repo/distribution is `redis` (the driver owns the
       `redis` import name, so the package can't also be `redis`)
     - pub/sub and pipeline helpers are intentionally not wrapped yet — use `.client`
+    - ssl=True maps to connection_class=redis.asyncio.SSLConnection so TLS actually
+      works via the documented pool_kwargs path; pass ssl-prefixed kwargs alongside it
+      (ssl_ca_certs, ssl_certfile, ...) to configure the handshake
 """
 
 import logging
@@ -75,12 +78,21 @@ class RedisDB:
         `timeout` is the pool's own kwarg (set from pool_timeout here), so passing it in
         pool_kwargs would collide — reject it with a clear pointer rather than let the
         driver raise a cryptic "multiple values for 'timeout'".
+
+        `ssl=True` is mapped to `connection_class=redis.asyncio.SSLConnection` — the
+        default async Connection class has no `ssl` parameter, so passing it straight
+        through pool_kwargs would defer the failure to connect() as a raw TypeError.
+        pass ssl-prefixed kwargs (ssl_ca_certs, ssl_certfile, ...) alongside ssl=True to
+        configure the TLS connection; an explicit connection_class in pool_kwargs is
+        left untouched.
         """
         if "timeout" in pool_kwargs:
             raise ValueError(
                 "redis_store: pass the pool wait timeout as pool_timeout=, not timeout= "
                 "(timeout is filled from pool_timeout)"
             )
+        if pool_kwargs.pop("ssl", False):
+            pool_kwargs.setdefault("connection_class", redis.SSLConnection)
         self._pool = redis.BlockingConnectionPool(
             host=host,
             port=port,