diff --git a/CHANGELOG.md b/CHANGELOG.md
index 69f7614..b14da94 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,14 @@ All notable changes to this project are documented in this file.
 
 Format inspired by [Keep a Changelog](https://keepachangelog.com/). Versioning follows [Semantic Versioning](https://semver.org/). Older entries live under [`changelog/`](changelog/).
 
+## [1.1.1] — 2026/05/18
+
+### Fixed
+
+- `MYSQL_OPT_SSL` and `MYSQL_OPT_SSL_CA` are now wired through to the connection builder. When `MYSQL_OPT_SSL` is enabled, `mysql_connect` configures `SslOpts::default()` on the pool (rustls). When `MYSQL_OPT_SSL_CA` is also set, its path is passed to `with_root_cert_path`; otherwise the platform trust store is used. Previously both options were accepted but silently ignored, so connections were always plaintext.
+
+---
+
 ## [1.1.0] — 2026/05/18
 
 Built on top of [rust-samp v3.0.0](https://github.com/NullSablex/rust-samp/releases/tag/v3.0.0). The same `.so` / `.dll` now loads on SA-MP and on Open Multiplayer (native component or legacy mode). No Pawn-visible API was removed or renamed.
diff --git a/CHECKLIST.md b/CHECKLIST.md
index 1bc99e1..2d89c21 100644
--- a/CHECKLIST.md
+++ b/CHECKLIST.md
@@ -1,6 +1,6 @@
 # Checklist: mysql_samp vs MySQL R41-4
 
-Coverage of the MySQL R41-4 (BlueG / maddinat0r) Pawn API by **mysql_samp 1.1.0**. Source of truth: [`include/mysql_samp.inc.in`](include/mysql_samp.inc.in) and [`src/lib.rs`](src/lib.rs).
+Coverage of the MySQL R41-4 (BlueG / maddinat0r) Pawn API by **mysql_samp 1.1.1**. Source of truth: [`include/mysql_samp.inc.in`](include/mysql_samp.inc.in) and [`src/lib.rs`](src/lib.rs).
 
 ## Connection
 
diff --git a/Cargo.lock b/Cargo.lock
index 75e296e..377fce0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -588,7 +588,7 @@ dependencies = [
 
 [[package]]
 name = "mysql_samp"
-version = "1.1.0"
+version = "1.1.1"
 dependencies = [
  "chrono",
  "mysql",
diff --git a/Cargo.toml b/Cargo.toml
index 9df5dd6..a08f168 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mysql_samp"
-version = "1.1.0"
+version = "1.1.1"
 edition = "2024"
 authors = ["NullSablex <https://github.com/NullSablex>"]
 repository = "https://github.com/NullSablex/mysql_samp"
diff --git a/docs/api-reference.md b/docs/api-reference.md
index f1d3367..ca68846 100644
--- a/docs/api-reference.md
+++ b/docs/api-reference.md
@@ -7,7 +7,7 @@ Source of truth: [`include/mysql_samp.inc.in`](https://github.com/NullSablex/mys
 ## Constants
 
 ```pawn
-#define MYSQL_SAMP_VERSION "1.1.0"
+#define MYSQL_SAMP_VERSION "1.1.1"
 ```
 
 The literal above is regenerated by `build.rs` from `CARGO_PKG_VERSION` on every build, so it always tracks the actual plugin version.
diff --git a/include/mysql_samp.inc b/include/mysql_samp.inc
index 7496110..9cae54a 100644
--- a/include/mysql_samp.inc
+++ b/include/mysql_samp.inc
@@ -1,5 +1,5 @@
 /*
- * mysql_samp v1.1.0 - MySQL plugin for SA-MP and Open Multiplayer.
+ * mysql_samp v1.1.1 - MySQL plugin for SA-MP and Open Multiplayer.
  * Author:     NullSablex
  * Repository: https://github.com/NullSablex/mysql_samp
  * License:    GPL-3.0
@@ -10,7 +10,7 @@
 #endif
 #define _mysql_samp_included
 
-#define MYSQL_SAMP_VERSION "1.1.0"
+#define MYSQL_SAMP_VERSION "1.1.1"
 
 // Connection options
 enum {
diff --git a/src/connection.rs b/src/connection.rs
index 4f06813..6becf59 100644
--- a/src/connection.rs
+++ b/src/connection.rs
@@ -1,8 +1,9 @@
 use std::collections::HashMap;
+use std::path::PathBuf;
 use std::time::Duration;
 
 use mysql::prelude::Queryable;
-use mysql::{Opts, OptsBuilder, Pool, PooledConn};
+use mysql::{Opts, OptsBuilder, Pool, PooledConn, SslOpts};
 
 use crate::cache::{CacheEntry, CacheRow};
 use crate::error::{ErrorState, MysqlError};
@@ -64,7 +65,15 @@ impl ConnectionManager {
             builder
         };
 
-        // TODO: SSL configuration when mysql crate exposes rustls options
+        let builder = if options.ssl {
+            let mut ssl_opts = SslOpts::default();
+            if let Some(ca) = options.ssl_ca.as_deref() {
+                ssl_opts = ssl_opts.with_root_cert_path(Some(PathBuf::from(ca)));
+            }
+            builder.ssl_opts(Some(ssl_opts))
+        } else {
+            builder
+        };
 
         // Force UTF-8 encoding on every connection for safe string escaping
         let builder = builder.init(vec!["SET NAMES utf8mb4"]);