diff --git a/CONFIG.md b/CONFIG.md
index e4b72d8..e04a431 100644
--- a/CONFIG.md
+++ b/CONFIG.md
@@ -601,8 +601,19 @@ cache:
     addr: 10.81.192.4:6379
 ```
 
+**Or with TLS enabled:**
+
+```yaml
+cache:
+  id: cache
+  config:
+    addr: redis.example.com:6380
+    use_tls: "true"
+```
+
 **Parameters**:
 - `addr`: Redis server address and port
+- `use_tls`: Enable TLS connection to Redis (`"true"` to enable, omit or any other value to disable). Default: disabled.
 
 ---
 
diff --git a/pkg/plugin/implementation/cache/cache.go b/pkg/plugin/implementation/cache/cache.go
index 1e38f96..c7c5a0c 100644
--- a/pkg/plugin/implementation/cache/cache.go
+++ b/pkg/plugin/implementation/cache/cache.go
@@ -2,6 +2,7 @@ package cache
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"os"
@@ -31,7 +32,8 @@ type RedisClient interface {
 
 // Config holds the configuration required to connect to Redis.
 type Config struct {
-	Addr string
+	Addr   string
+	UseTLS bool
 }
 
 // Cache wraps a Redis client to provide basic caching operations.
@@ -62,11 +64,15 @@ func validate(cfg *Config) error {
 // RedisClientFunc is a function variable that creates a Redis client based on the provided configuration.
 // It can be overridden for testing purposes.
 var RedisClientFunc = func(cfg *Config) RedisClient {
-	return redis.NewClient(&redis.Options{
+	opts := &redis.Options{
 		Addr:     cfg.Addr,
 		Password: os.Getenv("REDIS_PASSWORD"),
 		DB:       0,
-	})
+	}
+	if cfg.UseTLS {
+		opts.TLSConfig = &tls.Config{}
+	}
+	return redis.NewClient(opts)
 }
 
 // New initializes and returns a Cache instance along with a close function to release resources.
diff --git a/pkg/plugin/implementation/cache/cmd/plugin.go b/pkg/plugin/implementation/cache/cmd/plugin.go
index 5653495..0b33c0c 100644
--- a/pkg/plugin/implementation/cache/cmd/plugin.go
+++ b/pkg/plugin/implementation/cache/cmd/plugin.go
@@ -19,7 +19,8 @@ func (c cacheProvider) New(ctx context.Context, config map[string]string) (defin
 	}
 	// Create cache.Config directly from map - validation is handled by cache.New
 	cacheConfig := &cache.Config{
-		Addr: config["addr"],
+		Addr:   config["addr"],
+		UseTLS: config["use_tls"] == "true",
 	}
 	log.Debugf(ctx, "Cache config mapped: %+v", cacheConfig)
 	cache, closer, err := cache.New(ctx, cacheConfig)