diff --git a/nexus/Cargo.lock b/nexus/Cargo.lock
index 81d0785ae..26658dd2c 100644
--- a/nexus/Cargo.lock
+++ b/nexus/Cargo.lock
@@ -459,13 +459,14 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-http-client"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e44697a9bded898dcd0b1cb997430d949b87f4f8940d91023ae9062bf218250"
+checksum = "073d330f94bdf1f47bb3e0f5d45dda1e372a54a553c39ab6e9646902c8c81594"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
+ "h2 0.3.26",
  "h2 0.4.10",
  "http 0.2.12",
  "http 1.3.1",
@@ -2905,9 +2906,9 @@ dependencies = [
 
 [[package]]
 name = "pgwire"
-version = "0.28.0"
+version = "0.30.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c84e671791f3a354f265e55e400be8bb4b6262c1ec04fac4289e710ccf22ab43"
+checksum = "4ca6c26b25be998208a13ff2f0c55b567363f34675410e6d6f1c513a150583fd"
 dependencies = [
  "async-trait",
  "aws-lc-rs",
@@ -2920,8 +2921,9 @@ dependencies = [
  "lazy-regex",
  "md5",
  "postgres-types",
- "rand 0.8.5",
+ "rand 0.9.1",
  "rust_decimal",
+ "rustls-pki-types",
  "stringprep",
  "thiserror 2.0.12",
  "tokio",
@@ -4665,9 +4667,9 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.5"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cc2d9e086a412a451384326f521c8123a99a466b329941a9403696bff9b0da2"
+checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
 dependencies = [
  "bitflags",
  "bytes",
diff --git a/nexus/Cargo.toml b/nexus/Cargo.toml
index 00070007f..11c61d5ba 100644
--- a/nexus/Cargo.toml
+++ b/nexus/Cargo.toml
@@ -32,7 +32,7 @@ ssh2 = "0.9"
 sqlparser = { git = "https://github.com/peerdb-io/sqlparser-rs.git", branch = "main" }
 tokio = { version = "1", features = ["full"] }
 tracing = "0.1"
-pgwire = { version = "0.28", default-features = false, features = [
+pgwire = { version = "0.30", default-features = false, features = [
   "scram",
   "server-api-aws-lc-rs",
 ] }
diff --git a/nexus/parser/src/lib.rs b/nexus/parser/src/lib.rs
index ba167027e..86bae929e 100644
--- a/nexus/parser/src/lib.rs
+++ b/nexus/parser/src/lib.rs
@@ -7,7 +7,7 @@ use analyzer::{
 use async_trait::async_trait;
 use catalog::Catalog;
 use pgwire::{
-    api::{Type, stmt::QueryParser},
+    api::{ClientInfo, Type, stmt::QueryParser},
     error::{ErrorInfo, PgWireError, PgWireResult},
 };
 use sqlparser::{ast::Statement, dialect::PostgreSqlDialect, parser::Parser};
@@ -146,7 +146,15 @@ impl NexusQueryParser {
 impl QueryParser for NexusQueryParser {
     type Statement = NexusParsedStatement;
 
-    async fn parse_sql(&self, sql: &str, _types: &[Type]) -> PgWireResult<Self::Statement> {
+    async fn parse_sql<C>(
+        &self,
+        _client: &C,
+        sql: &str,
+        _types: &[Type],
+    ) -> PgWireResult<Self::Statement>
+    where
+        C: ClientInfo + Unpin + Send + Sync,
+    {
         let mut stmts =
             Parser::parse_sql(&DIALECT, sql).map_err(|e| PgWireError::ApiError(Box::new(e)))?;
         if stmts.len() > 1 {
diff --git a/nexus/server/src/main.rs b/nexus/server/src/main.rs
index 7edd11f41..3b0f9d037 100644
--- a/nexus/server/src/main.rs
+++ b/nexus/server/src/main.rs
@@ -1,6 +1,6 @@
 use std::{
     collections::{HashMap, HashSet},
-    fmt::Write,
+    fmt::{Debug, Write},
     fs::File,
     io,
     sync::Arc,
@@ -15,6 +15,7 @@ use clap::Parser;
 use cursor::PeerCursors;
 use dashmap::{DashMap, mapref::entry::Entry as DashEntry};
 use flow_rs::grpc::{FlowGrpcClient, PeerCreationResult};
+use futures::Sink;
 use peer_connections::{PeerConnectionTracker, PeerConnections};
 use peer_cursor::{
     QueryExecutor, QueryOutput, Schema,
@@ -23,7 +24,7 @@ use peer_cursor::{
 use peerdb_parser::{NexusParsedStatement, NexusQueryParser, NexusStatement};
 use pgwire::{
     api::{
-        ClientInfo, NoopErrorHandler, PgWireServerHandlers, Type,
+        ClientInfo, ClientPortalStore, NoopErrorHandler, PgWireServerHandlers, Type,
         auth::{
             AuthSource, LoginInfo, Password, ServerParameterProvider,
             scram::{SASLScramAuthStartupHandler, gen_salted_password},
@@ -35,8 +36,10 @@ use pgwire::{
             DescribePortalResponse, DescribeResponse, DescribeStatementResponse, Response, Tag,
         },
         stmt::StoredStatement,
+        store::PortalStore,
     },
     error::{ErrorInfo, PgWireError, PgWireResult},
+    messages::PgWireBackendMessage,
     tokio::process_socket,
 };
 use pt::{
@@ -751,13 +754,11 @@ impl NexusBackend {
 
 #[async_trait]
 impl SimpleQueryHandler for NexusBackend {
-    async fn do_query<'a, C>(
-        &self,
-        _client: &mut C,
-        sql: &'a str,
-    ) -> PgWireResult<Vec<Response<'a>>>
+    async fn do_query<'a, C>(&self, _client: &mut C, sql: &str) -> PgWireResult<Vec<Response<'a>>>
     where
-        C: ClientInfo + Unpin + Send + Sync,
+        C: ClientInfo + ClientPortalStore + Sink<PgWireBackendMessage> + Unpin + Send + Sync,
+        C::Error: Debug,
+        PgWireError: From<<C as Sink<PgWireBackendMessage>>::Error>,
     {
         let parsed = self.query_parser.parse_simple_sql(sql).await?;
         let nexus_stmt = parsed.statement;
@@ -818,11 +819,14 @@ impl ExtendedQueryHandler for NexusBackend {
     async fn do_query<'a, C>(
         &self,
         _client: &mut C,
-        portal: &'a Portal<Self::Statement>,
+        portal: &Portal<Self::Statement>,
         _max_rows: usize,
     ) -> PgWireResult<Response<'a>>
     where
-        C: ClientInfo + Unpin + Send + Sync,
+        C: ClientInfo + ClientPortalStore + Sink<PgWireBackendMessage> + Unpin + Send + Sync,
+        C::PortalStore: PortalStore<Statement = Self::Statement>,
+        C::Error: Debug,
+        PgWireError: From<<C as Sink<PgWireBackendMessage>>::Error>,
     {
         let stmt = &portal.statement.statement;
         tracing::info!("[eqp] do_query: {}", stmt.query);
@@ -1135,7 +1139,7 @@ pub async fn main() -> anyhow::Result<()> {
         Arc::new(NexusServerParameterProvider),
     );
 
-    let tls_acceptor = setup_tls(&args)?.map(Arc::new);
+    let tls_acceptor = setup_tls(&args)?;
 
     let peer_conns = {
         let conn_str = catalog_config.to_pg_connection_string();