diff --git a/fineract-doc/src/docs/en/chapters/appendix/properties-database.adoc b/fineract-doc/src/docs/en/chapters/appendix/properties-database.adoc
index 988a9c38f..074afbaed 100644
--- a/fineract-doc/src/docs/en/chapters/appendix/properties-database.adoc
+++ b/fineract-doc/src/docs/en/chapters/appendix/properties-database.adoc
@@ -63,4 +63,35 @@
 |FINERACT_LIQUIBASE_ENABLED
 |true
 |TBD
+
+|fineract.tenant.read-only-name
+|FINERACT_DEFAULT_TENANTDB_RO_NAME
+|
+|
+
+|fineract.tenant.read-only-host
+|FINERACT_DEFAULT_TENANTDB_RO_HOSTNAME
+|
+|
+
+|fineract.tenant.read-only-port
+|FINERACT_DEFAULT_TENANTDB_RO_PORT
+|
+|
+
+|fineract.tenant.read-only-username
+|FINERACT_DEFAULT_TENANTDB_RO_UID
+|
+|
+
+|fineract.tenant.read-only-password
+|FINERACT_DEFAULT_TENANTDB_RO_PWD
+|
+|
+
+|fineract.tenant.read-only-parameters
+|FINERACT_DEFAULT_TENANTDB_RO_CONN_PARAMS
+|
+|
+
 |===
diff --git a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/FineractProperties.java b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/FineractProperties.java
index 0ee0bc852..ad4abe2f3 100644
--- a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/FineractProperties.java
+++ b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/FineractProperties.java
@@ -80,6 +80,12 @@ public class FineractProperties {
         private String masterPassword;
         private String encryption;
 
+        private String readOnlyHost;
+        private Integer readOnlyPort;
+        private String readOnlyUsername;
+        private String readOnlyPassword;
+        private String readOnlyParameters;
+        private String readOnlyName;
     }
 
     @Getter
diff --git a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/service/migration/TenantDatabaseUpgradeService.java b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/service/migration/TenantDatabaseUpgradeService.java
index 623c49532..ae5828e79 100644
--- a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/service/migration/TenantDatabaseUpgradeService.java
+++ b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/service/migration/TenantDatabaseUpgradeService.java
@@ -29,6 +29,7 @@ import liquibase.exception.LiquibaseException;
 import liquibase.integration.spring.SpringLiquibase;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.fineract.infrastructure.core.boot.FineractProfiles;
 import org.apache.fineract.infrastructure.core.config.FineractProperties;
 import org.apache.fineract.infrastructure.core.domain.FineractPlatformTenant;
@@ -108,6 +109,13 @@ public class TenantDatabaseUpgradeService implements InitializingBean {
         log.info("- fineract.tenant.description: {}", fineractProperties.getTenant().getDescription());
         log.info("- fineract.tenant.identifier: {}", fineractProperties.getTenant().getIdentifier());
         log.info("- fineract.tenant.name: {}", fineractProperties.getTenant().getName());
+
+        log.info("- fineract.tenant.username: {}", fineractProperties.getTenant().getReadOnlyUsername());
+        log.info("- fineract.tenant.password: {}",
+                StringUtils.isNotBlank(fineractProperties.getTenant().getReadOnlyPassword()) ? "****" : "");
+        log.info("- fineract.tenant.parameters: {}", fineractProperties.getTenant().getReadOnlyParameters());
+        log.info("- fineract.tenant.name: {}", fineractProperties.getTenant().getReadOnlyName());
+
     }
 
     private void upgradeIndividualTenants() throws LiquibaseException {
diff --git a/fineract-provider/src/main/resources/application.properties b/fineract-provider/src/main/resources/application.properties
index d5fa1c77f..0545d1b14 100644
--- a/fineract-provider/src/main/resources/application.properties
+++ b/fineract-provider/src/main/resources/application.properties
@@ -37,6 +37,13 @@ fineract.tenant.description=${FINERACT_DEFAULT_TENANTDB_DESCRIPTION:Default Demo
 fineract.tenant.master-password=${FINERACT_DEFAULT_TENANTDB_MASTER_PASSWORD:fineract}
 fineract.tenant.encrytion=${FINERACT_DEFAULT_TENANTDB_ENCRYPTION:"AES/CBC/PKCS5Padding"}
 
+fineract.tenant.read-only-host=${FINERACT_DEFAULT_TENANTDB_RO_HOSTNAME:}
+fineract.tenant.read-only-port=${FINERACT_DEFAULT_TENANTDB_RO_PORT:}
+fineract.tenant.read-only-username=${FINERACT_DEFAULT_TENANTDB_RO_UID:}
+fineract.tenant.read-only-password=${FINERACT_DEFAULT_TENANTDB_RO_PWD:}
+fineract.tenant.read-only-parameters=${FINERACT_DEFAULT_TENANTDB_RO_CONN_PARAMS:}
+fineract.tenant.read-only-name=${FINERACT_DEFAULT_TENANTDB_RO_NAME:}
+
 fineract.mode.read-enabled=${FINERACT_MODE_READ_ENABLED:true}
 fineract.mode.write-enabled=${FINERACT_MODE_WRITE_ENABLED:true}
 fineract.mode.batch-worker-enabled=${FINERACT_MODE_BATCH_WORKER_ENABLED:true}
@@ -190,6 +197,12 @@ spring.liquibase.parameters.fineract.tenant.port=${fineract.tenant.port}
 spring.liquibase.parameters.fineract.tenant.username=${fineract.tenant.username}
 spring.liquibase.parameters.fineract.tenant.password=${fineract.tenant.password}
 spring.liquibase.parameters.fineract.tenant.parameters=${fineract.tenant.parameters}
+spring.liquibase.parameters.fineract.tenant.read-only-host=${fineract.tenant.read-only-host}
+spring.liquibase.parameters.fineract.tenant.read-only-port=${fineract.tenant.read-only-port}
+spring.liquibase.parameters.fineract.tenant.read-only-username=${fineract.tenant.read-only-username}
+spring.liquibase.parameters.fineract.tenant.read-only-password=${fineract.tenant.read-only-password}
+spring.liquibase.parameters.fineract.tenant.read-only-parameters=${fineract.tenant.read-only-parameters}
+spring.liquibase.parameters.fineract.tenant.read-only-name=${fineract.tenant.read-only-name}
 
 springdoc.api-docs.path=${SPRINGDOC_API_DOCS_PATH:/api-docs}
 springdoc.api-docs.enabled=${SPRINGDOC_API_DOCS_ENABLED:true}
diff --git a/fineract-provider/src/main/resources/db/changelog/tenant-store/changelog-tenant-store.xml b/fineract-provider/src/main/resources/db/changelog/tenant-store/changelog-tenant-store.xml
index 42c4aba73..ae5bb4f01 100644
--- a/fineract-provider/src/main/resources/db/changelog/tenant-store/changelog-tenant-store.xml
+++ b/fineract-provider/src/main/resources/db/changelog/tenant-store/changelog-tenant-store.xml
@@ -28,4 +28,5 @@
      <include file="parts/0006_drop_retry_parameter_columns.xml" relativeToChangelogFile="true"/>
      <include file="parts/0007_encrypt_existing_tenant_passwords.xml" relativeToChangelogFile="true"/>
      <include file="parts/0008_encrypt_existing_ro_tenant_passwords.xml" relativeToChangelogFile="true"/>
+     <include file="parts/0009_set_and_encrypt_ro_if_not_exists.xml" relativeToChangelogFile="true"/>
 </databaseChangeLog>
diff --git a/fineract-provider/src/main/resources/db/changelog/tenant-store/parts/0009_set_and_encrypt_ro_if_not_exists.xml b/fineract-provider/src/main/resources/db/changelog/tenant-store/parts/0009_set_and_encrypt_ro_if_not_exists.xml
new file mode 100644
index 000000000..abcd696a0
--- /dev/null
+++ b/fineract-provider/src/main/resources/db/changelog/tenant-store/parts/0009_set_and_encrypt_ro_if_not_exists.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+    <changeSet author="fineract" id="1" context="tenant_store_db">
+        <preConditions onFail="CONTINUE">
+            <sqlCheck expectedResult="1">
+                SELECT count(1) FROM tenant_server_connections WHERE id = 1 and readonly_schema_password is null and readonly_schema_username is null and readonly_schema_name is null;
+            </sqlCheck>
+        </preConditions>
+        <update tableName="tenant_server_connections">
+            <column name="readonly_schema_server" value="${fineract.tenant.read-only-host}"/>
+            <column name="readonly_schema_name" value="${fineract.tenant.read-only-name}"/>
+            <column name="readonly_schema_server_port" value="${fineract.tenant.read-only-port}"/>
+            <column name="readonly_schema_username" value="${fineract.tenant.read-only-username}"/>
+            <column name="readonly_schema_password" value="${fineract.tenant.read-only-password}"/>
+            <column name="readonly_schema_connection_parameters" value="${fineract.tenant.read-only-parameters}"/>
+        </update>
+        <customChange class="org.apache.fineract.infrastructure.core.service.migration.TenantReadOnlyPasswordEncryptionTask"/>
+    </changeSet>
+</databaseChangeLog>