diff --git a/backend/tests/test_delivery.py b/backend/tests/test_delivery.py
index 0f479c2..ddbaf76 100644
--- a/backend/tests/test_delivery.py
+++ b/backend/tests/test_delivery.py
@@ -3,6 +3,7 @@
 import importlib
 import json
 import os
+import re
 import secrets
 import stat
 import struct
@@ -1255,6 +1256,17 @@ def credential_acl(uid=1203, *, owner=4, user=4, group=0, mask=4, other=0):
     )
 
 
+def test_external_postgres_configuration_binds_ident_file_to_initialized_data():
+    files = dependencies.render("sd-123456789abc", "cfg-" + "e" * 24)
+    text = files["postgresql.conf"].decode()
+    paths = dict(re.findall(r"^(data_directory|ident_file|hba_file) = '([^']+)'$", text, re.M))
+    assert set(paths) == {"data_directory", "ident_file", "hba_file"}
+    assert Path(paths["ident_file"]) == Path(paths["data_directory"]) / "pg_ident.conf"
+    assert Path(paths["hba_file"]).parent == dependencies.CONFIGURATION_ROOT / (
+        "sd-123456789abc.cfg-" + "e" * 24
+    )
+
+
 @pytest.mark.parametrize("uid", [1201, 1202, 1203])
 def test_credential_acl_has_exactly_one_service_reader(uid):
     assert credentials.validate_acl(credential_acl(uid), uid) is None
diff --git a/scripts/release/dependencies.py b/scripts/release/dependencies.py
index 3f2f410..a3a18ee 100644
--- a/scripts/release/dependencies.py
+++ b/scripts/release/dependencies.py
@@ -220,6 +220,7 @@ def render(release: str, batch: str) -> dict[str, bytes]:
         "\n".join(
             [
                 "data_directory = '/var/lib/kf-onlinejudge/postgres/data'",
+                "ident_file = '/var/lib/kf-onlinejudge/postgres/data/pg_ident.conf'",
                 f"hba_file = '{base}/pg_hba.conf'",
                 "listen_addresses = '127.0.0.1'",
                 "port = 5432",