diff --git a/build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml b/build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml
index d600b02bbb..5c24792891 100644
--- a/build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml
+++ b/build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml
@@ -22041,6 +22041,66 @@ spec:
                       - pgbackrest
                       type: string
                     type: array
+                  dcs:
+                    description: |-
+                      DCS configures the distributed configuration store backend.
+                      Defaults to the Kubernetes-native backend (Endpoints).
+                      N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+                    properties:
+                      etcd:
+                        description: |-
+                          Etcd holds settings for the external etcd DCS backend.
+                          Required when type is "etcd".
+                        properties:
+                          authSecret:
+                            description: |-
+                              AuthSecret is the name of a Secret in the same namespace with keys
+                              username and password for etcd authentication.
+                            type: string
+                          endpoints:
+                            description: |-
+                              Endpoints is the list of etcd endpoints including scheme and port.
+                              Example: ["https://etcd.etcd-cluster.svc:2379"]
+                              The scheme of the first endpoint determines the protocol used.
+                              All endpoints must use the same scheme.
+                            items:
+                              pattern: ^https?://[^/]
+                              type: string
+                            maxItems: 7
+                            minItems: 1
+                            type: array
+                            x-kubernetes-validations:
+                            - message: all endpoints must use the same scheme (http
+                                or https)
+                              rule: self.all(e, url(e).getScheme() == 'http') || self.all(e,
+                                url(e).getScheme() == 'https')
+                          tlsSecret:
+                            description: |-
+                              TLSSecret is the name of a Secret in the same namespace with keys
+                              ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+                            type: string
+                        required:
+                        - endpoints
+                        type: object
+                      type:
+                        allOf:
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        default: kubernetes
+                        description: PatroniDCSType identifies which DCS backend Patroni
+                          should use.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: etcd.endpoints must be non-empty when type is etcd
+                      rule: self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints)
+                        > 0)
+                    - message: DCS type is immutable after cluster creation
+                      rule: '!has(oldSelf.type) || oldSelf.type == self.type'
                   dynamicConfiguration:
                     description: |-
                       Patroni dynamic configuration settings. Changes to this value will be
diff --git a/build/postgres-operator/Dockerfile b/build/postgres-operator/Dockerfile
index 45c38b9745..a3de6223a5 100644
--- a/build/postgres-operator/Dockerfile
+++ b/build/postgres-operator/Dockerfile
@@ -70,6 +70,7 @@ COPY build/postgres-operator/postgres-entrypoint.sh /usr/local/bin
 COPY build/postgres-operator/postgres-liveness-check.sh /usr/local/bin
 COPY build/postgres-operator/postgres-readiness-check.sh /usr/local/bin
 COPY build/postgres-operator/restore-command-wrapper.sh /usr/local/bin
+COPY build/postgres-operator/patroni-role-change.sh /usr/local/bin
 COPY hack/tools/queries /opt/crunchy/conf
 
 RUN chgrp -R 0 /opt/crunchy/conf && chmod -R g=u opt/crunchy/conf
diff --git a/build/postgres-operator/init-entrypoint.sh b/build/postgres-operator/init-entrypoint.sh
index 3090212fbf..e7c503538c 100755
--- a/build/postgres-operator/init-entrypoint.sh
+++ b/build/postgres-operator/init-entrypoint.sh
@@ -11,3 +11,4 @@ install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "/usr/local/bin/postgres-liveness
 install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "/usr/local/bin/postgres-readiness-check.sh" "${CRUNCHY_BINDIR}/bin/postgres-readiness-check.sh"
 install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "/usr/local/bin/relocate-extensions.sh" "${CRUNCHY_BINDIR}/bin/relocate-extensions.sh"
 install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "/usr/local/bin/restore-command-wrapper.sh" "${CRUNCHY_BINDIR}/bin/restore-command-wrapper.sh"
+install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "/usr/local/bin/patroni-role-change.sh" "${CRUNCHY_BINDIR}/bin/patroni-role-change.sh"
diff --git a/build/postgres-operator/patroni-role-change.sh b/build/postgres-operator/patroni-role-change.sh
new file mode 100755
index 0000000000..bc2e2bc989
--- /dev/null
+++ b/build/postgres-operator/patroni-role-change.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+# Patroni on_role_change / on_start callback.
+# Called by Patroni as: <script> <event> <role> <scope>
+# With etcd DCS, Patroni does not update pod labels or annotations.
+# This script patches both so that:
+#   - Service selectors work (role label)
+#   - IsWritable() works (status annotation read by the operator)
+
+ROLE=${2}
+
+NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
+TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
+CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+POD=${HOSTNAME}
+
+case "${ROLE}" in
+    master|primary)  LABEL="primary" ;;
+    replica)         LABEL="replica" ;;
+    *)               LABEL="${ROLE}" ;;
+esac
+
+PATCH_BODY="{\"metadata\":{\"labels\":{\"postgres-operator.crunchydata.com/role\":\"${LABEL}\"},\"annotations\":{\"status\":\"{\\\"role\\\":\\\"${LABEL}\\\"}\"}}}"
+
+curl -sf -X PATCH \
+    --retry 3 --retry-delay 1 --retry-connrefused \
+    --cacert "${CA}" \
+    -H "Authorization: Bearer ${TOKEN}" \
+    -H "Content-Type: application/strategic-merge-patch+json" \
+    "https://kubernetes.default.svc/api/v1/namespaces/${NAMESPACE}/pods/${POD}" \
+    -d "${PATCH_BODY}"
diff --git a/cmd/postgres-operator/main.go b/cmd/postgres-operator/main.go
index bf7ce2dfe3..0779955f6d 100644
--- a/cmd/postgres-operator/main.go
+++ b/cmd/postgres-operator/main.go
@@ -197,6 +197,15 @@ func addControllersToManager(ctx context.Context, mgr manager.Manager) error {
 		return err
 	}
 
+	if err := mgr.GetFieldIndexer().IndexField(
+		context.Background(),
+		&v2.PerconaPGCluster{},
+		v2.IndexFieldPatroniEtcdSecrets,
+		v2.PatroniEtcdSecretsIndexerFunc,
+	); err != nil {
+		return err
+	}
+
 	externalEvents := make(chan event.GenericEvent)
 	stopChan := make(chan event.DeleteEvent)
 
diff --git a/config/crd/bases/pgv2.percona.com_perconapgclusters.yaml b/config/crd/bases/pgv2.percona.com_perconapgclusters.yaml
index 2ff064e994..ce6ffbe444 100644
--- a/config/crd/bases/pgv2.percona.com_perconapgclusters.yaml
+++ b/config/crd/bases/pgv2.percona.com_perconapgclusters.yaml
@@ -22739,6 +22739,66 @@ spec:
                       - pgbackrest
                       type: string
                     type: array
+                  dcs:
+                    description: |-
+                      DCS configures the distributed configuration store backend.
+                      Defaults to the Kubernetes-native backend (Endpoints).
+                      N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+                    properties:
+                      etcd:
+                        description: |-
+                          Etcd holds settings for the external etcd DCS backend.
+                          Required when type is "etcd".
+                        properties:
+                          authSecret:
+                            description: |-
+                              AuthSecret is the name of a Secret in the same namespace with keys
+                              username and password for etcd authentication.
+                            type: string
+                          endpoints:
+                            description: |-
+                              Endpoints is the list of etcd endpoints including scheme and port.
+                              Example: ["https://etcd.etcd-cluster.svc:2379"]
+                              The scheme of the first endpoint determines the protocol used.
+                              All endpoints must use the same scheme.
+                            items:
+                              pattern: ^https?://[^/]
+                              type: string
+                            maxItems: 7
+                            minItems: 1
+                            type: array
+                            x-kubernetes-validations:
+                            - message: all endpoints must use the same scheme (http
+                                or https)
+                              rule: self.all(e, url(e).getScheme() == 'http') || self.all(e,
+                                url(e).getScheme() == 'https')
+                          tlsSecret:
+                            description: |-
+                              TLSSecret is the name of a Secret in the same namespace with keys
+                              ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+                            type: string
+                        required:
+                        - endpoints
+                        type: object
+                      type:
+                        allOf:
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        default: kubernetes
+                        description: PatroniDCSType identifies which DCS backend Patroni
+                          should use.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: etcd.endpoints must be non-empty when type is etcd
+                      rule: self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints)
+                        > 0)
+                    - message: DCS type is immutable after cluster creation
+                      rule: '!has(oldSelf.type) || oldSelf.type == self.type'
                   dynamicConfiguration:
                     description: |-
                       Patroni dynamic configuration settings. Changes to this value will be
diff --git a/config/crd/bases/upstream.pgv2.percona.com_postgresclusters.yaml b/config/crd/bases/upstream.pgv2.percona.com_postgresclusters.yaml
index 63c7ec1cf2..ecf93df225 100644
--- a/config/crd/bases/upstream.pgv2.percona.com_postgresclusters.yaml
+++ b/config/crd/bases/upstream.pgv2.percona.com_postgresclusters.yaml
@@ -22382,6 +22382,66 @@ spec:
                       - pgbackrest
                       type: string
                     type: array
+                  dcs:
+                    description: |-
+                      DCS configures the distributed configuration store backend.
+                      Defaults to the Kubernetes-native backend (Endpoints).
+                      N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+                    properties:
+                      etcd:
+                        description: |-
+                          Etcd holds settings for the external etcd DCS backend.
+                          Required when type is "etcd".
+                        properties:
+                          authSecret:
+                            description: |-
+                              AuthSecret is the name of a Secret in the same namespace with keys
+                              username and password for etcd authentication.
+                            type: string
+                          endpoints:
+                            description: |-
+                              Endpoints is the list of etcd endpoints including scheme and port.
+                              Example: ["https://etcd.etcd-cluster.svc:2379"]
+                              The scheme of the first endpoint determines the protocol used.
+                              All endpoints must use the same scheme.
+                            items:
+                              pattern: ^https?://[^/]
+                              type: string
+                            maxItems: 7
+                            minItems: 1
+                            type: array
+                            x-kubernetes-validations:
+                            - message: all endpoints must use the same scheme (http
+                                or https)
+                              rule: self.all(e, url(e).getScheme() == 'http') || self.all(e,
+                                url(e).getScheme() == 'https')
+                          tlsSecret:
+                            description: |-
+                              TLSSecret is the name of a Secret in the same namespace with keys
+                              ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+                            type: string
+                        required:
+                        - endpoints
+                        type: object
+                      type:
+                        allOf:
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        default: kubernetes
+                        description: PatroniDCSType identifies which DCS backend Patroni
+                          should use.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: etcd.endpoints must be non-empty when type is etcd
+                      rule: self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints)
+                        > 0)
+                    - message: DCS type is immutable after cluster creation
+                      rule: '!has(oldSelf.type) || oldSelf.type == self.type'
                   dynamicConfiguration:
                     description: |-
                       Patroni dynamic configuration settings. Changes to this value will be
diff --git a/deploy/bundle.yaml b/deploy/bundle.yaml
index fff58aecba..26ed767063 100644
--- a/deploy/bundle.yaml
+++ b/deploy/bundle.yaml
@@ -23036,6 +23036,66 @@ spec:
                       - pgbackrest
                       type: string
                     type: array
+                  dcs:
+                    description: |-
+                      DCS configures the distributed configuration store backend.
+                      Defaults to the Kubernetes-native backend (Endpoints).
+                      N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+                    properties:
+                      etcd:
+                        description: |-
+                          Etcd holds settings for the external etcd DCS backend.
+                          Required when type is "etcd".
+                        properties:
+                          authSecret:
+                            description: |-
+                              AuthSecret is the name of a Secret in the same namespace with keys
+                              username and password for etcd authentication.
+                            type: string
+                          endpoints:
+                            description: |-
+                              Endpoints is the list of etcd endpoints including scheme and port.
+                              Example: ["https://etcd.etcd-cluster.svc:2379"]
+                              The scheme of the first endpoint determines the protocol used.
+                              All endpoints must use the same scheme.
+                            items:
+                              pattern: ^https?://[^/]
+                              type: string
+                            maxItems: 7
+                            minItems: 1
+                            type: array
+                            x-kubernetes-validations:
+                            - message: all endpoints must use the same scheme (http
+                                or https)
+                              rule: self.all(e, url(e).getScheme() == 'http') || self.all(e,
+                                url(e).getScheme() == 'https')
+                          tlsSecret:
+                            description: |-
+                              TLSSecret is the name of a Secret in the same namespace with keys
+                              ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+                            type: string
+                        required:
+                        - endpoints
+                        type: object
+                      type:
+                        allOf:
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        default: kubernetes
+                        description: PatroniDCSType identifies which DCS backend Patroni
+                          should use.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: etcd.endpoints must be non-empty when type is etcd
+                      rule: self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints)
+                        > 0)
+                    - message: DCS type is immutable after cluster creation
+                      rule: '!has(oldSelf.type) || oldSelf.type == self.type'
                   dynamicConfiguration:
                     description: |-
                       Patroni dynamic configuration settings. Changes to this value will be
@@ -60499,6 +60559,66 @@ spec:
                       - pgbackrest
                       type: string
                     type: array
+                  dcs:
+                    description: |-
+                      DCS configures the distributed configuration store backend.
+                      Defaults to the Kubernetes-native backend (Endpoints).
+                      N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+                    properties:
+                      etcd:
+                        description: |-
+                          Etcd holds settings for the external etcd DCS backend.
+                          Required when type is "etcd".
+                        properties:
+                          authSecret:
+                            description: |-
+                              AuthSecret is the name of a Secret in the same namespace with keys
+                              username and password for etcd authentication.
+                            type: string
+                          endpoints:
+                            description: |-
+                              Endpoints is the list of etcd endpoints including scheme and port.
+                              Example: ["https://etcd.etcd-cluster.svc:2379"]
+                              The scheme of the first endpoint determines the protocol used.
+                              All endpoints must use the same scheme.
+                            items:
+                              pattern: ^https?://[^/]
+                              type: string
+                            maxItems: 7
+                            minItems: 1
+                            type: array
+                            x-kubernetes-validations:
+                            - message: all endpoints must use the same scheme (http
+                                or https)
+                              rule: self.all(e, url(e).getScheme() == 'http') || self.all(e,
+                                url(e).getScheme() == 'https')
+                          tlsSecret:
+                            description: |-
+                              TLSSecret is the name of a Secret in the same namespace with keys
+                              ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+                            type: string
+                        required:
+                        - endpoints
+                        type: object
+                      type:
+                        allOf:
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        default: kubernetes
+                        description: PatroniDCSType identifies which DCS backend Patroni
+                          should use.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: etcd.endpoints must be non-empty when type is etcd
+                      rule: self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints)
+                        > 0)
+                    - message: DCS type is immutable after cluster creation
+                      rule: '!has(oldSelf.type) || oldSelf.type == self.type'
                   dynamicConfiguration:
                     description: |-
                       Patroni dynamic configuration settings. Changes to this value will be
diff --git a/deploy/crd.yaml b/deploy/crd.yaml
index 340b6668f4..4f5b8b937a 100644
--- a/deploy/crd.yaml
+++ b/deploy/crd.yaml
@@ -23036,6 +23036,66 @@ spec:
                       - pgbackrest
                       type: string
                     type: array
+                  dcs:
+                    description: |-
+                      DCS configures the distributed configuration store backend.
+                      Defaults to the Kubernetes-native backend (Endpoints).
+                      N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+                    properties:
+                      etcd:
+                        description: |-
+                          Etcd holds settings for the external etcd DCS backend.
+                          Required when type is "etcd".
+                        properties:
+                          authSecret:
+                            description: |-
+                              AuthSecret is the name of a Secret in the same namespace with keys
+                              username and password for etcd authentication.
+                            type: string
+                          endpoints:
+                            description: |-
+                              Endpoints is the list of etcd endpoints including scheme and port.
+                              Example: ["https://etcd.etcd-cluster.svc:2379"]
+                              The scheme of the first endpoint determines the protocol used.
+                              All endpoints must use the same scheme.
+                            items:
+                              pattern: ^https?://[^/]
+                              type: string
+                            maxItems: 7
+                            minItems: 1
+                            type: array
+                            x-kubernetes-validations:
+                            - message: all endpoints must use the same scheme (http
+                                or https)
+                              rule: self.all(e, url(e).getScheme() == 'http') || self.all(e,
+                                url(e).getScheme() == 'https')
+                          tlsSecret:
+                            description: |-
+                              TLSSecret is the name of a Secret in the same namespace with keys
+                              ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+                            type: string
+                        required:
+                        - endpoints
+                        type: object
+                      type:
+                        allOf:
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        default: kubernetes
+                        description: PatroniDCSType identifies which DCS backend Patroni
+                          should use.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: etcd.endpoints must be non-empty when type is etcd
+                      rule: self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints)
+                        > 0)
+                    - message: DCS type is immutable after cluster creation
+                      rule: '!has(oldSelf.type) || oldSelf.type == self.type'
                   dynamicConfiguration:
                     description: |-
                       Patroni dynamic configuration settings. Changes to this value will be
@@ -60499,6 +60559,66 @@ spec:
                       - pgbackrest
                       type: string
                     type: array
+                  dcs:
+                    description: |-
+                      DCS configures the distributed configuration store backend.
+                      Defaults to the Kubernetes-native backend (Endpoints).
+                      N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+                    properties:
+                      etcd:
+                        description: |-
+                          Etcd holds settings for the external etcd DCS backend.
+                          Required when type is "etcd".
+                        properties:
+                          authSecret:
+                            description: |-
+                              AuthSecret is the name of a Secret in the same namespace with keys
+                              username and password for etcd authentication.
+                            type: string
+                          endpoints:
+                            description: |-
+                              Endpoints is the list of etcd endpoints including scheme and port.
+                              Example: ["https://etcd.etcd-cluster.svc:2379"]
+                              The scheme of the first endpoint determines the protocol used.
+                              All endpoints must use the same scheme.
+                            items:
+                              pattern: ^https?://[^/]
+                              type: string
+                            maxItems: 7
+                            minItems: 1
+                            type: array
+                            x-kubernetes-validations:
+                            - message: all endpoints must use the same scheme (http
+                                or https)
+                              rule: self.all(e, url(e).getScheme() == 'http') || self.all(e,
+                                url(e).getScheme() == 'https')
+                          tlsSecret:
+                            description: |-
+                              TLSSecret is the name of a Secret in the same namespace with keys
+                              ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+                            type: string
+                        required:
+                        - endpoints
+                        type: object
+                      type:
+                        allOf:
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        default: kubernetes
+                        description: PatroniDCSType identifies which DCS backend Patroni
+                          should use.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: etcd.endpoints must be non-empty when type is etcd
+                      rule: self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints)
+                        > 0)
+                    - message: DCS type is immutable after cluster creation
+                      rule: '!has(oldSelf.type) || oldSelf.type == self.type'
                   dynamicConfiguration:
                     description: |-
                       Patroni dynamic configuration settings. Changes to this value will be
diff --git a/deploy/cw-bundle.yaml b/deploy/cw-bundle.yaml
index eb89883bf0..2f462bdeff 100644
--- a/deploy/cw-bundle.yaml
+++ b/deploy/cw-bundle.yaml
@@ -23036,6 +23036,66 @@ spec:
                       - pgbackrest
                       type: string
                     type: array
+                  dcs:
+                    description: |-
+                      DCS configures the distributed configuration store backend.
+                      Defaults to the Kubernetes-native backend (Endpoints).
+                      N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+                    properties:
+                      etcd:
+                        description: |-
+                          Etcd holds settings for the external etcd DCS backend.
+                          Required when type is "etcd".
+                        properties:
+                          authSecret:
+                            description: |-
+                              AuthSecret is the name of a Secret in the same namespace with keys
+                              username and password for etcd authentication.
+                            type: string
+                          endpoints:
+                            description: |-
+                              Endpoints is the list of etcd endpoints including scheme and port.
+                              Example: ["https://etcd.etcd-cluster.svc:2379"]
+                              The scheme of the first endpoint determines the protocol used.
+                              All endpoints must use the same scheme.
+                            items:
+                              pattern: ^https?://[^/]
+                              type: string
+                            maxItems: 7
+                            minItems: 1
+                            type: array
+                            x-kubernetes-validations:
+                            - message: all endpoints must use the same scheme (http
+                                or https)
+                              rule: self.all(e, url(e).getScheme() == 'http') || self.all(e,
+                                url(e).getScheme() == 'https')
+                          tlsSecret:
+                            description: |-
+                              TLSSecret is the name of a Secret in the same namespace with keys
+                              ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+                            type: string
+                        required:
+                        - endpoints
+                        type: object
+                      type:
+                        allOf:
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        default: kubernetes
+                        description: PatroniDCSType identifies which DCS backend Patroni
+                          should use.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: etcd.endpoints must be non-empty when type is etcd
+                      rule: self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints)
+                        > 0)
+                    - message: DCS type is immutable after cluster creation
+                      rule: '!has(oldSelf.type) || oldSelf.type == self.type'
                   dynamicConfiguration:
                     description: |-
                       Patroni dynamic configuration settings. Changes to this value will be
@@ -60499,6 +60559,66 @@ spec:
                       - pgbackrest
                       type: string
                     type: array
+                  dcs:
+                    description: |-
+                      DCS configures the distributed configuration store backend.
+                      Defaults to the Kubernetes-native backend (Endpoints).
+                      N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+                    properties:
+                      etcd:
+                        description: |-
+                          Etcd holds settings for the external etcd DCS backend.
+                          Required when type is "etcd".
+                        properties:
+                          authSecret:
+                            description: |-
+                              AuthSecret is the name of a Secret in the same namespace with keys
+                              username and password for etcd authentication.
+                            type: string
+                          endpoints:
+                            description: |-
+                              Endpoints is the list of etcd endpoints including scheme and port.
+                              Example: ["https://etcd.etcd-cluster.svc:2379"]
+                              The scheme of the first endpoint determines the protocol used.
+                              All endpoints must use the same scheme.
+                            items:
+                              pattern: ^https?://[^/]
+                              type: string
+                            maxItems: 7
+                            minItems: 1
+                            type: array
+                            x-kubernetes-validations:
+                            - message: all endpoints must use the same scheme (http
+                                or https)
+                              rule: self.all(e, url(e).getScheme() == 'http') || self.all(e,
+                                url(e).getScheme() == 'https')
+                          tlsSecret:
+                            description: |-
+                              TLSSecret is the name of a Secret in the same namespace with keys
+                              ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+                            type: string
+                        required:
+                        - endpoints
+                        type: object
+                      type:
+                        allOf:
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        - enum:
+                          - kubernetes
+                          - etcd
+                        default: kubernetes
+                        description: PatroniDCSType identifies which DCS backend Patroni
+                          should use.
+                        type: string
+                    type: object
+                    x-kubernetes-validations:
+                    - message: etcd.endpoints must be non-empty when type is etcd
+                      rule: self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints)
+                        > 0)
+                    - message: DCS type is immutable after cluster creation
+                      rule: '!has(oldSelf.type) || oldSelf.type == self.type'
                   dynamicConfiguration:
                     description: |-
                       Patroni dynamic configuration settings. Changes to this value will be
diff --git a/e2e-tests/run-pr.csv b/e2e-tests/run-pr.csv
index 91472001a7..5f55796b49 100644
--- a/e2e-tests/run-pr.csv
+++ b/e2e-tests/run-pr.csv
@@ -34,6 +34,7 @@ telemetry-transfer
 upgrade-consistency
 upgrade-minor
 users
+etcd-dcs
 migration-from-crunchy-standby
 migration-from-crunchy-pv
 migration-from-crunchy-backup-restore
diff --git a/e2e-tests/run-release.csv b/e2e-tests/run-release.csv
index 787d2e4ef1..78f6337db4 100644
--- a/e2e-tests/run-release.csv
+++ b/e2e-tests/run-release.csv
@@ -39,6 +39,7 @@ telemetry-transfer
 upgrade-consistency
 upgrade-minor
 users
+etcd-dcs
 migration-from-crunchy-backup-restore
 migration-from-crunchy-pv
 migration-from-crunchy-standby
diff --git a/e2e-tests/tests/etcd-dcs/00-assert.yaml b/e2e-tests/tests/etcd-dcs/00-assert.yaml
new file mode 100644
index 0000000000..ae5a062d84
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/00-assert.yaml
@@ -0,0 +1,24 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 120
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: perconapgclusters.pgv2.percona.com
+spec:
+  group: pgv2.percona.com
+  names:
+    kind: PerconaPGCluster
+    listKind: PerconaPGClusterList
+    plural: perconapgclusters
+    singular: perconapgcluster
+  scope: Namespaced
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+metadata:
+  name: check-operator-deploy-status
+timeout: 120
+commands:
+  - script: kubectl assert exist-enhanced deployment percona-postgresql-operator -n ${OPERATOR_NS:-$NAMESPACE} --field-selector status.readyReplicas=1
diff --git a/e2e-tests/tests/etcd-dcs/00-deploy-operator.yaml b/e2e-tests/tests/etcd-dcs/00-deploy-operator.yaml
new file mode 100644
index 0000000000..1aaca58be2
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/00-deploy-operator.yaml
@@ -0,0 +1,13 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 10
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+      init_temp_dir # do this only in the first TestStep
+
+      deploy_operator
+      deploy_client
diff --git a/e2e-tests/tests/etcd-dcs/01-assert.yaml b/e2e-tests/tests/etcd-dcs/01-assert.yaml
new file mode 100644
index 0000000000..c335c6b202
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/01-assert.yaml
@@ -0,0 +1,10 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 120
+---
+kind: StatefulSet
+apiVersion: apps/v1
+metadata:
+  name: etcd
+status:
+  readyReplicas: 1
diff --git a/e2e-tests/tests/etcd-dcs/01-etcd-setup.yaml b/e2e-tests/tests/etcd-dcs/01-etcd-setup.yaml
new file mode 100644
index 0000000000..298073ecd2
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/01-etcd-setup.yaml
@@ -0,0 +1,61 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+
+      kubectl -n "${NAMESPACE}" apply -f - <<EOF
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: etcd
+      spec:
+        clusterIP: None
+        ports:
+          - name: etcd-client
+            port: 2379
+            targetPort: 2379
+          - name: etcd-peer
+            port: 2380
+            targetPort: 2380
+        selector:
+          app: etcd
+      ---
+      apiVersion: apps/v1
+      kind: StatefulSet
+      metadata:
+        name: etcd
+      spec:
+        serviceName: etcd
+        replicas: 1
+        selector:
+          matchLabels:
+            app: etcd
+        template:
+          metadata:
+            labels:
+              app: etcd
+          spec:
+            containers:
+              - name: etcd
+                image: registry.k8s.io/etcd:3.6.6-0
+                command:
+                  - /usr/local/bin/etcd
+                  - --name=etcd-0
+                  - --data-dir=/var/etcd/data
+                  - --listen-client-urls=http://0.0.0.0:2379
+                  - --advertise-client-urls=http://etcd-0.etcd.${NAMESPACE}.svc:2379
+                  - --listen-peer-urls=http://0.0.0.0:2380
+                  - --initial-advertise-peer-urls=http://etcd-0.etcd.${NAMESPACE}.svc:2380
+                  - --initial-cluster=etcd-0=http://etcd-0.etcd.${NAMESPACE}.svc:2380
+                  - --initial-cluster-state=new
+                  - --initial-cluster-token=etcd-cluster-token
+                ports:
+                  - containerPort: 2379
+                    name: client
+                  - containerPort: 2380
+                    name: peer
+      EOF
diff --git a/e2e-tests/tests/etcd-dcs/02-assert.yaml b/e2e-tests/tests/etcd-dcs/02-assert.yaml
new file mode 100644
index 0000000000..3d092bf63c
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/02-assert.yaml
@@ -0,0 +1,103 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 120
+---
+# With etcd DCS the primary Service selects on role=primary, which is applied
+# only by the patroni-role-change.sh callback. Cluster "ready" (below) is gated
+# on pod readiness, not on that label, so wait for the labeled primary pod here
+# before writing data through the primary Service.
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+    postgres-operator.crunchydata.com/role: primary
+status:
+  phase: Running
+---
+kind: StatefulSet
+apiVersion: apps/v1
+metadata:
+  labels:
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+    postgres-operator.crunchydata.com/data: postgres
+    postgres-operator.crunchydata.com/instance-set: instance1
+  ownerReferences:
+    - apiVersion: upstream.pgv2.percona.com/v1beta1
+      kind: PostgresCluster
+      name: etcd-dcs
+      controller: true
+      blockOwnerDeletion: true
+status:
+  observedGeneration: 1
+  replicas: 1
+  readyReplicas: 1
+  currentReplicas: 1
+  updatedReplicas: 1
+  collisionCount: 0
+---
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: etcd-dcs-pgbouncer
+  labels:
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+    postgres-operator.crunchydata.com/role: pgbouncer
+  annotations:
+    deployment.kubernetes.io/revision: '1'
+  ownerReferences:
+    - apiVersion: upstream.pgv2.percona.com/v1beta1
+      kind: PostgresCluster
+      name: etcd-dcs
+      controller: true
+      blockOwnerDeletion: true
+status:
+  observedGeneration: 1
+  replicas: 1
+  updatedReplicas: 1
+  readyReplicas: 1
+---
+apiVersion: upstream.pgv2.percona.com/v1beta1
+kind: PostgresCluster
+metadata:
+  name: etcd-dcs
+  ownerReferences:
+    - apiVersion: pgv2.percona.com/v2
+      kind: PerconaPGCluster
+      name: etcd-dcs
+      controller: true
+      blockOwnerDeletion: true
+  finalizers:
+    - postgres-operator.crunchydata.com/finalizer
+status:
+  instances:
+    - name: instance1
+      readyReplicas: 1
+      replicas: 1
+      updatedReplicas: 1
+  observedGeneration: 1
+  pgbackrest:
+    repos:
+      - name: repo1
+        stanzaCreated: true
+  proxy:
+    pgBouncer:
+      readyReplicas: 1
+      replicas: 1
+---
+apiVersion: pgv2.percona.com/v2
+kind: PerconaPGCluster
+metadata:
+  name: etcd-dcs
+status:
+  pgbouncer:
+    ready: 1
+    size: 1
+  postgres:
+    instances:
+    - name: instance1
+      ready: 1
+      size: 1
+    ready: 1
+    size: 1
+  state: ready
diff --git a/e2e-tests/tests/etcd-dcs/02-create-cluster.yaml b/e2e-tests/tests/etcd-dcs/02-create-cluster.yaml
new file mode 100644
index 0000000000..a414233119
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/02-create-cluster.yaml
@@ -0,0 +1,19 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 10
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+
+      ETCD_ENDPOINT="http://etcd-0.etcd.${NAMESPACE}.svc:2379"
+
+      get_cr \
+        | yq eval '
+            .spec.proxy.pgBouncer.replicas=1 |
+            .spec.instances[].replicas=1' - \
+        | yq eval '.spec.patroni.dcs.type = "etcd"' - \
+        | yq eval ".spec.patroni.dcs.etcd.endpoints = [\"${ETCD_ENDPOINT}\"]" - \
+        | kubectl -n "${NAMESPACE}" apply -f -
diff --git a/e2e-tests/tests/etcd-dcs/03-write-data.yaml b/e2e-tests/tests/etcd-dcs/03-write-data.yaml
new file mode 100644
index 0000000000..5f331b2d51
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/03-write-data.yaml
@@ -0,0 +1,16 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+
+      run_psql_local \
+        'CREATE DATABASE myapp; \c myapp \\\ CREATE TABLE IF NOT EXISTS myApp (id int PRIMARY KEY);' \
+        "postgres:$(get_psql_user_pass etcd-dcs-pguser-postgres)@$(get_psql_user_host etcd-dcs-pguser-postgres)"
+
+      run_psql_local \
+        '\c myapp \\\ INSERT INTO myApp (id) VALUES (100500)' \
+        "postgres:$(get_psql_user_pass etcd-dcs-pguser-postgres)@$(get_psql_user_host etcd-dcs-pguser-postgres)"
diff --git a/e2e-tests/tests/etcd-dcs/04-assert.yaml b/e2e-tests/tests/etcd-dcs/04-assert.yaml
new file mode 100644
index 0000000000..6848a5b79a
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/04-assert.yaml
@@ -0,0 +1,10 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 30
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: 03-read-from-primary
+data:
+  data: ' 100500'
diff --git a/e2e-tests/tests/etcd-dcs/04-read-from-primary.yaml b/e2e-tests/tests/etcd-dcs/04-read-from-primary.yaml
new file mode 100644
index 0000000000..a81a24c14c
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/04-read-from-primary.yaml
@@ -0,0 +1,13 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 30
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+
+      data=$(run_psql_local '\c myapp \\\ SELECT * from myApp;' "postgres:$(get_psql_user_pass etcd-dcs-pguser-postgres)@$(get_psql_user_host etcd-dcs-pguser-postgres)")
+
+      kubectl create configmap -n "${NAMESPACE}" 03-read-from-primary --from-literal=data="${data}"
diff --git a/e2e-tests/tests/etcd-dcs/05-assert.yaml b/e2e-tests/tests/etcd-dcs/05-assert.yaml
new file mode 100644
index 0000000000..a926d85b07
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/05-assert.yaml
@@ -0,0 +1,131 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 300
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+    postgres-operator.crunchydata.com/pgbackrest: ""
+    postgres-operator.crunchydata.com/pgbackrest-config: ""
+  name: etcd-dcs-pgbackrest
+type: Opaque
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+    postgres-operator.crunchydata.com/cluster-certificate: replication-client-tls
+  name: etcd-dcs-replication-cert
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+    postgres-operator.crunchydata.com/pguser: postgres
+    postgres-operator.crunchydata.com/role: pguser
+  name: etcd-dcs-pguser-postgres
+type: Opaque
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+    postgres-operator.crunchydata.com/pguser: etcd-dcs
+    postgres-operator.crunchydata.com/role: pguser
+  name: etcd-dcs-pguser-etcd-dcs
+type: Opaque
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    app.kubernetes.io/component: pgbouncer
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+    postgres-operator.crunchydata.com/role: pgbouncer
+  name: etcd-dcs-pgbouncer
+type: Opaque
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+    postgres-operator.crunchydata.com/cluster-certificate: postgres-tls
+  name: etcd-dcs-cluster-cert
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: etcd-dcs-cluster-ca-cert
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+  name: etcd-dcs-config
+  ownerReferences:
+  - apiVersion: upstream.pgv2.percona.com/v1beta1
+    blockOwnerDeletion: true
+    controller: true
+    kind: PostgresCluster
+    name: etcd-dcs
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+    postgres-operator.crunchydata.com/pgbackrest: ""
+    postgres-operator.crunchydata.com/pgbackrest-config: ""
+  name: etcd-dcs-pgbackrest-config
+  ownerReferences:
+  - apiVersion: upstream.pgv2.percona.com/v1beta1
+    blockOwnerDeletion: true
+    controller: true
+    kind: PostgresCluster
+    name: etcd-dcs
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: pgbouncer
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+    postgres-operator.crunchydata.com/role: pgbouncer
+  name: etcd-dcs-pgbouncer
+  ownerReferences:
+  - apiVersion: upstream.pgv2.percona.com/v1beta1
+    blockOwnerDeletion: true
+    controller: true
+    kind: PostgresCluster
+    name: etcd-dcs
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    postgres-operator.crunchydata.com/cluster: etcd-dcs
+    postgres-operator.crunchydata.com/data: pgbackrest
+    postgres-operator.crunchydata.com/pgbackrest: ""
+    postgres-operator.crunchydata.com/pgbackrest-dedicated: ""
+  name: etcd-dcs-repo-host
+  ownerReferences:
+  - apiVersion: upstream.pgv2.percona.com/v1beta1
+    blockOwnerDeletion: true
+    controller: true
+    kind: PostgresCluster
+    name: etcd-dcs
+status:
+  availableReplicas: 1
+  collisionCount: 0
+  currentReplicas: 1
+  observedGeneration: 1
+  readyReplicas: 1
+  replicas: 1
+  updatedReplicas: 1
diff --git a/e2e-tests/tests/etcd-dcs/06-check-patroni-config.yaml b/e2e-tests/tests/etcd-dcs/06-check-patroni-config.yaml
new file mode 100644
index 0000000000..35a6eca85f
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/06-check-patroni-config.yaml
@@ -0,0 +1,23 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 30
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+
+      patroni_yaml=$(kubectl -n "${NAMESPACE}" get configmap etcd-dcs-config \
+        -o jsonpath='{.data.patroni\.yaml}')
+
+      echo "${patroni_yaml}" | grep -q "etcd3:"
+      echo "${patroni_yaml}" | grep -q "protocol: http"
+      echo "${patroni_yaml}" | grep -q "callbacks:"
+      echo "${patroni_yaml}" | grep -q "on_start: /opt/crunchy/bin/patroni-role-change.sh"
+      echo "${patroni_yaml}" | grep -q "on_role_change: /opt/crunchy/bin/patroni-role-change.sh"
+
+      if echo "${patroni_yaml}" | grep -q "kubernetes:"; then
+        echo "ERROR: patroni.yaml must not contain kubernetes: section when etcd DCS is configured"
+        exit 1
+      fi
diff --git a/e2e-tests/tests/etcd-dcs/07-check-patronictl.yaml b/e2e-tests/tests/etcd-dcs/07-check-patronictl.yaml
new file mode 100644
index 0000000000..605fc03bef
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/07-check-patronictl.yaml
@@ -0,0 +1,20 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 60
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+
+      instance=$(kubectl -n "${NAMESPACE}" get pod \
+        -l postgres-operator.crunchydata.com/instance-set=instance1 \
+        -o jsonpath='{.items[0].metadata.name}')
+
+      patronictl_out=$(kubectl -n "${NAMESPACE}" exec "${instance}" -c database -- \
+        patronictl list)
+
+      echo "${patronictl_out}"
+      echo "${patronictl_out}" | grep -q "Leader"
+      echo "${patronictl_out}" | grep -q "running"
diff --git a/e2e-tests/tests/etcd-dcs/08-check-etcd-keys.yaml b/e2e-tests/tests/etcd-dcs/08-check-etcd-keys.yaml
new file mode 100644
index 0000000000..bdce645403
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/08-check-etcd-keys.yaml
@@ -0,0 +1,16 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 30
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+
+      keys=$(kubectl -n "${NAMESPACE}" exec etcd-0 -- \
+        /usr/local/bin/etcdctl --endpoints=http://localhost:2379 \
+        get / --prefix --keys-only)
+
+      echo "${keys}"
+      echo "${keys}" | grep -q "etcd-dcs-ha"
diff --git a/e2e-tests/tests/etcd-dcs/09-check-no-warning-events.yaml b/e2e-tests/tests/etcd-dcs/09-check-no-warning-events.yaml
new file mode 100644
index 0000000000..5db07f5adc
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/09-check-no-warning-events.yaml
@@ -0,0 +1,20 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 10
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+
+      events=$(kubectl -n "${NAMESPACE}" get events \
+        --field-selector involvedObject.name=etcd-dcs,type=Warning \
+        -o jsonpath='{.items[*].reason}')
+
+      for reason in EtcdTLSSecretNotFound EtcdAuthSecretNotFound; do
+        if echo "${events}" | grep -q "${reason}"; then
+          echo "ERROR: found unexpected Warning event reason: ${reason}"
+          exit 1
+        fi
+      done
diff --git a/e2e-tests/tests/etcd-dcs/10-check-dcs-immutability.yaml b/e2e-tests/tests/etcd-dcs/10-check-dcs-immutability.yaml
new file mode 100644
index 0000000000..02382a426e
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/10-check-dcs-immutability.yaml
@@ -0,0 +1,22 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 10
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+
+      # Attempt to change the DCS type from etcd to kubernetes after cluster creation.
+      # The CRD CEL validation rule must reject this with "DCS type is immutable after cluster creation".
+      rejection_output=$(kubectl -n "${NAMESPACE}" patch perconapgcluster etcd-dcs \
+        --type=merge \
+        -p '{"spec":{"patroni":{"dcs":{"type":"kubernetes"}}}}' 2>&1 || true)
+
+      if echo "${rejection_output}" | grep -q "DCS type is immutable after cluster creation"; then
+        echo "OK: DCS type change correctly rejected by the API server"
+      else
+        echo "ERROR: expected rejection with 'DCS type is immutable after cluster creation', got: ${rejection_output}"
+        exit 1
+      fi
diff --git a/e2e-tests/tests/etcd-dcs/11-check-pod-labels.yaml b/e2e-tests/tests/etcd-dcs/11-check-pod-labels.yaml
new file mode 100644
index 0000000000..d19a22876c
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/11-check-pod-labels.yaml
@@ -0,0 +1,22 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 60
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+
+      # With etcd DCS, Patroni does not set pod role labels itself.
+      # The on_role_change callback script does. Verify it ran.
+      primary_pods=$(kubectl -n "${NAMESPACE}" get pods \
+        -l postgres-operator.crunchydata.com/cluster=etcd-dcs,postgres-operator.crunchydata.com/role=primary \
+        -o jsonpath='{.items[*].metadata.name}')
+
+      if [ -z "${primary_pods}" ]; then
+        echo "ERROR: no pod with role=primary label found; on_role_change callback may not have run"
+        exit 1
+      fi
+
+      echo "OK: primary pod(s) with role label: ${primary_pods}"
diff --git a/e2e-tests/tests/etcd-dcs/99-remove-cluster-gracefully.yaml b/e2e-tests/tests/etcd-dcs/99-remove-cluster-gracefully.yaml
new file mode 100644
index 0000000000..d10180f00a
--- /dev/null
+++ b/e2e-tests/tests/etcd-dcs/99-remove-cluster-gracefully.yaml
@@ -0,0 +1,30 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+delete:
+- apiVersion: pgv2.percona.com/v2
+  kind: PerconaPGCluster
+  metadata:
+    name: etcd-dcs
+- apiVersion: upstream.pgv2.percona.com/v1beta1
+  kind: PostgresCluster
+  metadata:
+    name: etcd-dcs
+- apiVersion: apps/v1
+  kind: StatefulSet
+  metadata:
+    name: etcd
+- apiVersion: v1
+  kind: Service
+  metadata:
+    name: etcd
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+
+      remove_all_finalizers
+      check_operator_panic
+      destroy_operator
+    timeout: 60
diff --git a/internal/controller/postgrescluster/cluster.go b/internal/controller/postgrescluster/cluster.go
index a8e4f56e2c..b5ec781b4a 100644
--- a/internal/controller/postgrescluster/cluster.go
+++ b/internal/controller/postgrescluster/cluster.go
@@ -122,9 +122,26 @@ func (r *Reconciler) generateClusterPrimaryService(
 	service.ObjectMeta.DeepCopyInto(&endpoints.ObjectMeta)
 	endpoints.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Endpoints"))
 
+	// With external DCS, Patroni does not manage k8s Endpoints for leader election.
+	// Use a label-selector service instead: pods labeled role=primary by the
+	// on_role_change/on_start callback receive primary traffic directly.
+	if cluster.UsesExternalDCS() {
+		service.Spec.Type = corev1.ServiceTypeClusterIP
+		service.Spec.Selector = map[string]string{
+			naming.LabelCluster: cluster.Name,
+			naming.LabelRole:    naming.RolePatroniLeader,
+		}
+		service.Spec.Ports = []corev1.ServicePort{{
+			Name:       naming.PortPostgreSQL,
+			Port:       *cluster.Spec.Port,
+			Protocol:   corev1.ProtocolTCP,
+			TargetPort: intstr.FromString(naming.PortPostgreSQL),
+		}}
+		return service, nil, err
+	}
+
 	if leader == nil {
-		// TODO(cbandy): We need to build a different kind of Service here.
-		return nil, nil, errors.New("Patroni DCS other than Kubernetes Endpoints is not implemented")
+		return nil, nil, errors.New("Patroni leader lease Service is missing")
 	}
 
 	// Allocate no IP address (headless) and manage the Endpoints ourselves.
@@ -176,7 +193,7 @@ func (r *Reconciler) reconcileClusterPrimaryService(
 	if err == nil {
 		err = errors.WithStack(r.apply(ctx, service))
 	}
-	if err == nil {
+	if err == nil && endpoints != nil {
 		err = errors.WithStack(r.apply(ctx, endpoints))
 	}
 	return service, err
@@ -298,7 +315,7 @@ func (r *Reconciler) reconcileDataSource(ctx context.Context,
 
 	// observe all resources currently relevant to reconciling data sources, and update status
 	// accordingly
-	endpoints, restoreJob, err := r.observeRestoreEnv(ctx, cluster)
+	endpoints, restoreJob, dcsCleanupJob, err := r.observeRestoreEnv(ctx, cluster)
 	if err != nil {
 		return false, errors.WithStack(err)
 	}
@@ -389,7 +406,7 @@ func (r *Reconciler) reconcileDataSource(ctx context.Context,
 	//   annotation, indicating they want a new in-place restore)
 	if (restoringInPlace && (!readyForRestore || configChanged)) || restoreIDChanged {
 		if err := r.prepareForRestore(ctx, cluster, observed, endpoints,
-			restoreJob, restoreID); err != nil {
+			restoreJob, dcsCleanupJob, restoreID); err != nil {
 			return true, err
 		}
 		// return early and don't restore (i.e. populate the data dir) until the cluster is
diff --git a/internal/controller/postgrescluster/cluster_test.go b/internal/controller/postgrescluster/cluster_test.go
index fb6eb19a1e..8fe5d2861c 100644
--- a/internal/controller/postgrescluster/cluster_test.go
+++ b/internal/controller/postgrescluster/cluster_test.go
@@ -594,7 +594,7 @@ func TestGenerateClusterPrimaryService(t *testing.T) {
 	leader.Spec.ClusterIP = "1.9.8.3"
 
 	_, _, err := reconciler.generateClusterPrimaryService(cluster, nil)
-	assert.ErrorContains(t, err, "not implemented")
+	assert.ErrorContains(t, err, "leader lease Service is missing")
 
 	alwaysExpect := func(t testing.TB, service *corev1.Service, endpoints *corev1.Endpoints) {
 		assert.Assert(t, cmp.MarshalMatches(service.TypeMeta, `
@@ -699,7 +699,7 @@ func TestReconcileClusterPrimaryService(t *testing.T) {
 	assert.NilError(t, cc.Create(ctx, cluster))
 
 	_, err := reconciler.reconcileClusterPrimaryService(ctx, cluster, nil)
-	assert.ErrorContains(t, err, "not implemented")
+	assert.ErrorContains(t, err, "leader lease Service is missing")
 
 	leader := &corev1.Service{}
 	leader.Spec.ClusterIP = "192.0.2.10"
diff --git a/internal/controller/postgrescluster/patroni.go b/internal/controller/postgrescluster/patroni.go
index 858b6cafd6..6c4170d876 100644
--- a/internal/controller/postgrescluster/patroni.go
+++ b/internal/controller/postgrescluster/patroni.go
@@ -6,6 +6,7 @@ package postgrescluster
 
 import (
 	"context"
+	"fmt"
 	"io"
 	"time"
 
@@ -46,32 +47,60 @@ func (r *Reconciler) deletePatroniArtifacts(
 	return err
 }
 
+// patroniPodHost returns pod's own stable DNS name, matching the DNS SAN on
+// its Patroni REST API certificate. Patroni's REST API does not certify
+// "localhost", so calls made inside the pod must target this name instead.
+func patroniPodHost(pod *corev1.Pod) string {
+	return fmt.Sprintf("%s.%s.%s.svc", pod.Spec.Hostname, pod.Spec.Subdomain, pod.Namespace)
+}
+
 func (r *Reconciler) handlePatroniRestarts(
 	ctx context.Context, cluster *v1beta1.PostgresCluster, instances *observedInstances,
 ) error {
 	const container = naming.ContainerDatabase
 	var primaryNeedsRestart, replicaNeedsRestart *Instance
 
+	// Only Kubernetes DCS has Patroni write the "status" pod annotation that
+	// PodRequiresRestart reads. Every external DCS backend (currently just etcd,
+	// but this isn't etcd-specific) needs a live check via Patroni's own
+	// monitoring REST API instead.
+	requiresRestart := func(pod *corev1.Pod) bool {
+		if !cluster.UsesExternalDCS() {
+			return patroni.PodRequiresRestart(pod)
+		}
+		exec := patroni.Executor(func(
+			ctx context.Context, stdin io.Reader, stdout, stderr io.Writer, command ...string,
+		) error {
+			return r.PodExec(ctx, pod.Namespace, pod.Name, container, stdin, stdout, stderr, command...)
+		})
+		restart, err := exec.PodRequiresRestart(ctx, patroniPodHost(pod), cluster.Spec.Patroni.GetPort())
+		return err == nil && restart
+	}
+
 	// Look for one primary and one replica that need to restart. Ignore
 	// containers that are terminating or not running; Kubernetes will start
 	// them again, and calls to their Patroni API will likely be interrupted anyway.
 	for _, instance := range instances.forCluster {
-		if len(instance.Pods) > 0 && patroni.PodRequiresRestart(instance.Pods[0]) {
-			if terminating, known := instance.IsTerminating(); terminating || !known {
-				continue
-			}
-			if running, known := instance.IsRunning(container); !running || !known {
-				continue
-			}
+		if len(instance.Pods) == 0 {
+			continue
+		}
+		if terminating, known := instance.IsTerminating(); terminating || !known {
+			continue
+		}
+		if running, known := instance.IsRunning(container); !running || !known {
+			continue
+		}
+		if !requiresRestart(instance.Pods[0]) {
+			continue
+		}
 
-			if primary, _ := instance.IsPrimary(); primary {
-				primaryNeedsRestart = instance
-			} else {
-				replicaNeedsRestart = instance
-			}
-			if primaryNeedsRestart != nil && replicaNeedsRestart != nil {
-				break
-			}
+		if primary, _ := instance.IsPrimary(); primary {
+			primaryNeedsRestart = instance
+		} else {
+			replicaNeedsRestart = instance
+		}
+		if primaryNeedsRestart != nil && replicaNeedsRestart != nil {
+			break
 		}
 	}
 
@@ -145,6 +174,12 @@ func (r *Reconciler) handlePatroniRestarts(
 func (r *Reconciler) reconcilePatroniDistributedConfiguration(
 	ctx context.Context, cluster *v1beta1.PostgresCluster,
 ) error {
+	// With an external DCS backend, Patroni stores distributed configuration there
+	// instead of in k8s Endpoints.
+	if cluster.UsesExternalDCS() {
+		return nil
+	}
+
 	// When using Endpoints for DCS, Patroni needs a Service to ensure that the
 	// Endpoints object is not removed by Kubernetes at startup. Patroni will
 	// create this object if it has permission to do so, but it won't set any
@@ -308,6 +343,11 @@ func (r *Reconciler) generatePatroniLeaderLeaseService(
 func (r *Reconciler) reconcilePatroniLeaderLease(
 	ctx context.Context, cluster *v1beta1.PostgresCluster,
 ) (*corev1.Service, error) {
+	// With an external DCS backend, Patroni does not use k8s Endpoints for leader elections.
+	if cluster.UsesExternalDCS() {
+		return nil, nil
+	}
+
 	// When using Endpoints for DCS, Patroni needs a Service to ensure that the
 	// Endpoints object is not removed by Kubernetes at startup.
 	// - https://releases.k8s.io/v1.16.0/pkg/controller/endpoint/endpoints_controller.go#L547
@@ -336,28 +376,80 @@ func (r *Reconciler) reconcilePatroniStatus(
 		}
 	}
 
-	dcs := &corev1.Endpoints{ObjectMeta: naming.PatroniDistributedConfiguration(cluster)}
-	err := errors.WithStack(client.IgnoreNotFound(
-		r.Client.Get(ctx, client.ObjectKeyFromObject(dcs), dcs)))
+	// Only Kubernetes DCS has Patroni write the "initialize" value to a
+	// Kubernetes Endpoints object.
+	if !cluster.UsesExternalDCS() {
+		dcs := &corev1.Endpoints{ObjectMeta: naming.PatroniDistributedConfiguration(cluster)}
+		err := errors.WithStack(client.IgnoreNotFound(
+			r.Client.Get(ctx, client.ObjectKeyFromObject(dcs), dcs)))
+
+		if err == nil {
+			if dcs.Annotations["initialize"] != "" {
+				// After bootstrap, Patroni writes the cluster system identifier to DCS.
+				cluster.Status.Patroni.SystemIdentifier = dcs.Annotations["initialize"]
+			} else if readyInstance {
+				// While we typically expect a value for the initialize key to be present in the
+				// Endpoints above by the time the StatefulSet for any instance indicates "ready"
+				// (since Patroni writes this value after successful cluster bootstrap, at which time
+				// the initial primary should transition to "ready"), sometimes this is not the case
+				// and the "initialize" key is not yet present.  Therefore, if a "ready" instance
+				// is detected in the cluster we assume this is the case, and simply log a message and
+				// requeue in order to try again until the expected value is found.
+				log.Info("detected ready instance but no initialize value")
+				requeue = time.Second
+			}
+		}
 
-	if err == nil {
-		if dcs.Annotations["initialize"] != "" {
-			// After bootstrap, Patroni writes the cluster system identifier to DCS.
-			cluster.Status.Patroni.SystemIdentifier = dcs.Annotations["initialize"]
-		} else if readyInstance {
-			// While we typically expect a value for the initialize key to be present in the
-			// Endpoints above by the time the StatefulSet for any instance indicates "ready"
-			// (since Patroni writes this value after successful cluster bootstrap, at which time
-			// the initial primary should transition to "ready"), sometimes this is not the case
-			// and the "initialize" key is not yet present.  Therefore, if a "ready" instance
-			// is detected in the cluster we assume this is the case, and simply log a message and
-			// requeue in order to try again until the expected value is found.
-			log.Info("detected ready instance but no initialize value")
-			requeue = time.Second
+		return requeue, err
+	} else {
+		// Every other DCS backend (currently just etcd, but this isn't
+		// etcd-specific) has no Kubernetes object to read "initialize" from.
+		// Ask a running instance directly via Patroni's own monitoring REST
+		// API instead, which reports the same value regardless of DCS backend.
+		if cluster.Status.Patroni.SystemIdentifier == "" {
+			var pod *corev1.Pod
+			for _, instance := range observedInstances.forCluster {
+				if terminating, known := instance.IsTerminating(); !terminating && known {
+					if running, known := instance.IsRunning(naming.ContainerDatabase); running && known && len(instance.Pods) > 0 {
+						pod = instance.Pods[0]
+						break
+					}
+				}
+			}
+
+			if pod == nil {
+				if readyInstance {
+					requeue = time.Second
+				}
+			} else {
+				exec := patroni.Executor(func(
+					ctx context.Context, stdin io.Reader, stdout, stderr io.Writer, command ...string,
+				) error {
+					return r.PodExec(ctx, pod.Namespace, pod.Name, naming.ContainerDatabase, stdin, stdout, stderr, command...)
+				})
+
+				status, err := exec.GetMemberStatus(ctx, patroniPodHost(pod), cluster.Spec.Patroni.GetPort())
+				if err == nil && status.DatabaseSystemIdentifier != "" {
+					cluster.Status.Patroni.SystemIdentifier = status.DatabaseSystemIdentifier
+				} else if readyInstance {
+					log.Info("detected ready instance but no system identifier yet")
+					requeue = time.Second
+				}
+			}
 		}
-	}
 
-	return requeue, err
+		if patroni.ClusterBootstrapped(cluster) {
+			// The pod-annotation watch that normally triggers reconciles for
+			// pending restarts never fires under non-Kubernetes DCS (Patroni
+			// doesn't write that annotation), so poll at roughly Patroni's
+			// own loop_wait cadence instead. See handlePatroniRestarts.
+			// cluster.Default() (called earlier in Reconcile) guarantees
+			// SyncPeriodSeconds is set.
+			requeue = time.Duration(*cluster.Spec.Patroni.SyncPeriodSeconds) * time.Second
+		}
+
+		return requeue, nil
+	}
 }
 
 // reconcileReplicationSecret creates a secret containing the TLS
diff --git a/internal/controller/postgrescluster/patroni_test.go b/internal/controller/postgrescluster/patroni_test.go
index 6ceb8069dc..b372f70b53 100644
--- a/internal/controller/postgrescluster/patroni_test.go
+++ b/internal/controller/postgrescluster/patroni_test.go
@@ -534,6 +534,199 @@ func TestReconcilePatroniStatus(t *testing.T) {
 	}
 }
 
+func TestReconcilePatroniStatusEtcd(t *testing.T) {
+	ctx := context.Background()
+
+	newCluster := func() *v1beta1.PostgresCluster {
+		cluster := &v1beta1.PostgresCluster{
+			ObjectMeta: metav1.ObjectMeta{Name: "etcd-status", Namespace: "postgres-operator"},
+			Spec: v1beta1.PostgresClusterSpec{
+				Patroni: &v1beta1.PatroniSpec{
+					DCS: &v1beta1.PatroniDCS{Type: v1beta1.PatroniDCSTypeEtcd},
+				},
+			},
+		}
+		// SyncPeriodSeconds is normally set by cluster.Default(), called
+		// earlier in Reconcile.
+		cluster.Spec.Patroni.Default()
+		return cluster
+	}
+
+	runningInstance := func() *observedInstances {
+		instance := &Instance{
+			Name: "instance",
+			Pods: []*corev1.Pod{{
+				ObjectMeta: metav1.ObjectMeta{Name: "instance-0", Namespace: "postgres-operator"},
+				Status: corev1.PodStatus{
+					Conditions: []corev1.PodCondition{{
+						Type: corev1.PodReady, Status: corev1.ConditionTrue,
+					}},
+					ContainerStatuses: []corev1.ContainerStatus{{
+						Name:  naming.ContainerDatabase,
+						State: corev1.ContainerState{Running: new(corev1.ContainerStateRunning)},
+					}},
+				},
+			}},
+		}
+		return &observedInstances{forCluster: []*Instance{instance}}
+	}
+
+	t.Run("SetsSystemIdentifierAndPolls", func(t *testing.T) {
+		cluster := newCluster()
+		r := &Reconciler{
+			PodExec: func(ctx context.Context, namespace, pod, container string,
+				stdin io.Reader, stdout, stderr io.Writer, command ...string) error {
+				_, _ = stdout.Write([]byte(
+					`{"state": "running", "database_system_identifier": "6952526174828511264"}`))
+				return nil
+			},
+		}
+
+		requeue, err := r.reconcilePatroniStatus(ctx, cluster, runningInstance())
+		assert.NilError(t, err)
+		assert.Equal(t, cluster.Status.Patroni.SystemIdentifier, "6952526174828511264")
+		// Once bootstrapped, expect polling at the (default) sync period,
+		// since the pod-annotation watch never fires under non-Kubernetes DCS.
+		assert.Equal(t, requeue, 10*time.Second)
+	})
+
+	t.Run("RetriesWhenNotYetAvailable", func(t *testing.T) {
+		cluster := newCluster()
+		r := &Reconciler{
+			PodExec: func(ctx context.Context, namespace, pod, container string,
+				stdin io.Reader, stdout, stderr io.Writer, command ...string) error {
+				return errors.New("connection refused")
+			},
+		}
+
+		requeue, err := r.reconcilePatroniStatus(ctx, cluster, runningInstance())
+		assert.NilError(t, err)
+		assert.Equal(t, cluster.Status.Patroni.SystemIdentifier, "")
+		assert.Equal(t, requeue, time.Second)
+	})
+
+	t.Run("SkipsExecOnceKnown", func(t *testing.T) {
+		cluster := newCluster()
+		cluster.Status.Patroni.SystemIdentifier = "already-known"
+		called := false
+		r := &Reconciler{
+			PodExec: func(ctx context.Context, namespace, pod, container string,
+				stdin io.Reader, stdout, stderr io.Writer, command ...string) error {
+				called = true
+				return errors.New("should not be called")
+			},
+		}
+
+		requeue, err := r.reconcilePatroniStatus(ctx, cluster, runningInstance())
+		assert.NilError(t, err)
+		assert.Assert(t, !called, "should not exec once SystemIdentifier is already known")
+		assert.Equal(t, cluster.Status.Patroni.SystemIdentifier, "already-known")
+		assert.Equal(t, requeue, 10*time.Second)
+	})
+
+	t.Run("NoRunningInstance", func(t *testing.T) {
+		cluster := newCluster()
+		r := &Reconciler{}
+
+		requeue, err := r.reconcilePatroniStatus(ctx, cluster, &observedInstances{})
+		assert.NilError(t, err)
+		assert.Equal(t, cluster.Status.Patroni.SystemIdentifier, "")
+		assert.Equal(t, requeue, time.Duration(0))
+	})
+}
+
+func TestHandlePatroniRestarts(t *testing.T) {
+	ctx := context.Background()
+
+	newInstance := func(annotations map[string]string) *observedInstances {
+		instance := &Instance{
+			Name: "instance",
+			Pods: []*corev1.Pod{{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "instance-0", Namespace: "postgres-operator",
+					Annotations: annotations,
+				},
+				Status: corev1.PodStatus{
+					ContainerStatuses: []corev1.ContainerStatus{{
+						Name:  naming.ContainerDatabase,
+						State: corev1.ContainerState{Running: new(corev1.ContainerStateRunning)},
+					}},
+				},
+			}},
+		}
+		return &observedInstances{forCluster: []*Instance{instance}}
+	}
+
+	t.Run("KubernetesDCSUsesAnnotation", func(t *testing.T) {
+		cluster := &v1beta1.PostgresCluster{ObjectMeta: metav1.ObjectMeta{Name: "k8s-restart"}}
+		observed := newInstance(map[string]string{"status": `{"role":"replica","pending_restart":true}`})
+
+		var restarted bool
+		r := &Reconciler{
+			PodExec: func(ctx context.Context, namespace, pod, container string,
+				stdin io.Reader, stdout, stderr io.Writer, command ...string) error {
+				assert.DeepEqual(t, command, strings.Fields(
+					`patronictl restart --pending --force --role=replica `+naming.PatroniScope(cluster)))
+				restarted = true
+				return nil
+			},
+		}
+
+		assert.NilError(t, r.handlePatroniRestarts(ctx, cluster, observed))
+		assert.Assert(t, restarted, "should restart via patronictl once annotation indicates pending_restart")
+	})
+
+	t.Run("EtcdDCSUsesRestAPI", func(t *testing.T) {
+		cluster := &v1beta1.PostgresCluster{
+			ObjectMeta: metav1.ObjectMeta{Name: "etcd-restart"},
+			Spec: v1beta1.PostgresClusterSpec{
+				Patroni: &v1beta1.PatroniSpec{DCS: &v1beta1.PatroniDCS{Type: v1beta1.PatroniDCSTypeEtcd}},
+			},
+		}
+		// No "status" annotation at all: Patroni never writes it under etcd DCS.
+		observed := newInstance(nil)
+
+		var restarted bool
+		r := &Reconciler{
+			PodExec: func(ctx context.Context, namespace, pod, container string,
+				stdin io.Reader, stdout, stderr io.Writer, command ...string) error {
+				if command[0] == "curl" {
+					_, _ = stdout.Write([]byte(`{"state": "running", "pending_restart": true}`))
+					return nil
+				}
+				assert.DeepEqual(t, command, strings.Fields(
+					`patronictl restart --pending --force --role=replica `+naming.PatroniScope(cluster)))
+				restarted = true
+				return nil
+			},
+		}
+
+		assert.NilError(t, r.handlePatroniRestarts(ctx, cluster, observed))
+		assert.Assert(t, restarted, "should restart once Patroni's REST API reports pending_restart")
+	})
+
+	t.Run("EtcdDCSNoRestartNeeded", func(t *testing.T) {
+		cluster := &v1beta1.PostgresCluster{
+			ObjectMeta: metav1.ObjectMeta{Name: "etcd-no-restart"},
+			Spec: v1beta1.PostgresClusterSpec{
+				Patroni: &v1beta1.PatroniSpec{DCS: &v1beta1.PatroniDCS{Type: v1beta1.PatroniDCSTypeEtcd}},
+			},
+		}
+		observed := newInstance(nil)
+
+		r := &Reconciler{
+			PodExec: func(ctx context.Context, namespace, pod, container string,
+				stdin io.Reader, stdout, stderr io.Writer, command ...string) error {
+				assert.Equal(t, command[0], "curl", "should only check status, never attempt a restart")
+				_, _ = stdout.Write([]byte(`{"state": "running", "pending_restart": false}`))
+				return nil
+			},
+		}
+
+		assert.NilError(t, r.handlePatroniRestarts(ctx, cluster, observed))
+	})
+}
+
 func TestReconcilePatroniSwitchover(t *testing.T) {
 	_, client := setupKubernetes(t)
 	require.ParallelCapacity(t, 0)
diff --git a/internal/controller/postgrescluster/pgbackrest.go b/internal/controller/postgrescluster/pgbackrest.go
index 4a51d94709..20d45cd99c 100644
--- a/internal/controller/postgrescluster/pgbackrest.go
+++ b/internal/controller/postgrescluster/pgbackrest.go
@@ -25,6 +25,7 @@ import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/labels"
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -992,6 +993,30 @@ func generateBackupJobSpecIntent(ctx context.Context, postgresCluster *v1beta1.P
 	return jobSpec
 }
 
+// findSingleJob returns the one Job matching selector in cluster's namespace, or nil
+// if none exists. Returns an error if more than one is found.
+func (r *Reconciler) findSingleJob(
+	ctx context.Context, cluster *v1beta1.PostgresCluster, selector labels.Selector, what string,
+) (*batchv1.Job, error) {
+	jobs := &batchv1.JobList{}
+	if err := r.Client.List(ctx, jobs, &client.ListOptions{
+		Namespace:     cluster.Namespace,
+		LabelSelector: selector,
+	}); err != nil {
+		return nil, errors.WithStack(err)
+	}
+	switch len(jobs.Items) {
+	case 0:
+		return nil, nil
+	case 1:
+		return &jobs.Items[0], nil
+	default:
+		return nil, errors.WithStack(
+			errors.New("invalid number of " + what + " found when attempting to reconcile a " +
+				"pgBackRest data source"))
+	}
+}
+
 // +kubebuilder:rbac:groups="",resources="configmaps",verbs={delete,list}
 // +kubebuilder:rbac:groups="",resources="secrets",verbs={list,delete}
 // +kubebuilder:rbac:groups="",resources="endpoints",verbs={get}
@@ -1004,14 +1029,14 @@ func generateBackupJobSpecIntent(ctx context.Context, postgresCluster *v1beta1.P
 // restore Jobs and then updating pgBackRest restore status accordingly.
 func (r *Reconciler) observeRestoreEnv(ctx context.Context,
 	cluster *v1beta1.PostgresCluster,
-) ([]corev1.Endpoints, *batchv1.Job, error) {
+) ([]corev1.Endpoints, *batchv1.Job, *batchv1.Job, error) {
 	// lookup the various patroni endpoints
 	leaderEP, dcsEP, failoverEP := corev1.Endpoints{}, corev1.Endpoints{}, corev1.Endpoints{}
 	currentEndpoints := []corev1.Endpoints{}
 	if err := r.Client.Get(ctx, naming.AsObjectKey(naming.PatroniLeaderEndpoints(cluster)),
 		&leaderEP); err != nil {
 		if !apierrors.IsNotFound(err) {
-			return nil, nil, errors.WithStack(err)
+			return nil, nil, nil, errors.WithStack(err)
 		}
 	} else {
 		currentEndpoints = append(currentEndpoints, leaderEP)
@@ -1019,7 +1044,7 @@ func (r *Reconciler) observeRestoreEnv(ctx context.Context,
 	if err := r.Client.Get(ctx, naming.AsObjectKey(naming.PatroniDistributedConfiguration(cluster)),
 		&dcsEP); err != nil {
 		if !apierrors.IsNotFound(err) {
-			return nil, nil, errors.WithStack(err)
+			return nil, nil, nil, errors.WithStack(err)
 		}
 	} else {
 		currentEndpoints = append(currentEndpoints, dcsEP)
@@ -1027,26 +1052,29 @@ func (r *Reconciler) observeRestoreEnv(ctx context.Context,
 	if err := r.Client.Get(ctx, naming.AsObjectKey(naming.PatroniTrigger(cluster)),
 		&failoverEP); err != nil {
 		if !apierrors.IsNotFound(err) {
-			return nil, nil, errors.WithStack(err)
+			return nil, nil, nil, errors.WithStack(err)
 		}
 	} else {
 		currentEndpoints = append(currentEndpoints, failoverEP)
 	}
 
-	restoreJobs := &batchv1.JobList{}
-	if err := r.Client.List(ctx, restoreJobs, &client.ListOptions{
-		Namespace:     cluster.Namespace,
-		LabelSelector: naming.PGBackRestRestoreJobSelector(cluster.GetName()),
-	}); err != nil {
-		return nil, nil, errors.WithStack(err)
+	restoreJob, err := r.findSingleJob(ctx, cluster,
+		naming.PGBackRestRestoreJobSelector(cluster.GetName()), "restore Jobs")
+	if err != nil {
+		return nil, nil, nil, err
 	}
-	var restoreJob *batchv1.Job
-	if len(restoreJobs.Items) > 1 {
-		return nil, nil, errors.WithStack(
-			errors.New("invalid number of restore Jobs found when attempting to reconcile a " +
-				"pgBackRest data source"))
-	} else if len(restoreJobs.Items) == 1 {
-		restoreJob = &restoreJobs.Items[0]
+
+	// Under an external DCS backend (e.g. etcd), Patroni never creates the Kubernetes
+	// Endpoints objects looked up above, so "currentEndpoints" can never signal that
+	// Patroni's DCS state is clean. Look up the Job that runs "patronictl remove"
+	// against the external DCS instead.
+	var dcsCleanupJob *batchv1.Job
+	if cluster.UsesExternalDCS() {
+		dcsCleanupJob, err = r.findSingleJob(ctx, cluster,
+			naming.PatroniDCSCleanupJobSelector(cluster.GetName()), "Patroni DCS cleanup Jobs")
+		if err != nil {
+			return nil, nil, nil, err
+		}
 	}
 
 	if restoreJob != nil {
@@ -1086,11 +1114,11 @@ func (r *Reconciler) observeRestoreEnv(ctx context.Context,
 				Namespace:     cluster.Namespace,
 				LabelSelector: selector,
 			}); err != nil {
-				return nil, nil, errors.WithStack(err)
+				return nil, nil, nil, errors.WithStack(err)
 			}
 			for i := range restoreConfigMaps.Items {
 				if err := r.Client.Delete(ctx, &restoreConfigMaps.Items[i]); err != nil {
-					return nil, nil, errors.WithStack(err)
+					return nil, nil, nil, errors.WithStack(err)
 				}
 			}
 			restoreSecrets := &corev1.SecretList{}
@@ -1098,11 +1126,11 @@ func (r *Reconciler) observeRestoreEnv(ctx context.Context,
 				Namespace:     cluster.Namespace,
 				LabelSelector: selector,
 			}); err != nil {
-				return nil, nil, errors.WithStack(err)
+				return nil, nil, nil, errors.WithStack(err)
 			}
 			for i := range restoreSecrets.Items {
 				if err := r.Client.Delete(ctx, &restoreSecrets.Items[i]); err != nil {
-					return nil, nil, errors.WithStack(err)
+					return nil, nil, nil, errors.WithStack(err)
 				}
 			}
 		} else if failed {
@@ -1116,7 +1144,7 @@ func (r *Reconciler) observeRestoreEnv(ctx context.Context,
 		}
 	}
 
-	return currentEndpoints, restoreJob, nil
+	return currentEndpoints, restoreJob, dcsCleanupJob, nil
 }
 
 // +kubebuilder:rbac:groups="",resources="endpoints",verbs={delete}
@@ -1130,7 +1158,7 @@ func (r *Reconciler) observeRestoreEnv(ctx context.Context,
 // cluster to re-bootstrap using a restored data directory.
 func (r *Reconciler) prepareForRestore(ctx context.Context,
 	cluster *v1beta1.PostgresCluster, observed *observedInstances,
-	currentEndpoints []corev1.Endpoints, restoreJob *batchv1.Job, restoreID string,
+	currentEndpoints []corev1.Endpoints, restoreJob, dcsCleanupJob *batchv1.Job, restoreID string,
 ) error {
 	setPreparingClusterCondition := func(resource string) {
 		meta.SetStatusCondition(&cluster.Status.Conditions, metav1.Condition{
@@ -1211,33 +1239,61 @@ func (r *Reconciler) prepareForRestore(ctx context.Context,
 		return nil
 	}
 
-	// if everything is gone, proceed with re-bootstrapping the cluster via an in-place restore
-	if len(currentEndpoints) == 0 {
-		meta.RemoveStatusCondition(&cluster.Status.Conditions, ConditionPostgresDataInitialized)
-		meta.SetStatusCondition(&cluster.Status.Conditions, metav1.Condition{
-			ObservedGeneration: cluster.GetGeneration(),
-			Type:               ConditionPGBackRestRestoreProgressing,
-			Status:             metav1.ConditionTrue,
-			Reason:             ReasonReadyForRestore,
-			Message:            "Restoring cluster in-place",
-		})
-		// the cluster is no longer bootstrapped
-		cluster.Status.Patroni.SystemIdentifier = ""
-		// the restore will change the contents of the database, so the pgbouncer and exporter hashes
-		// are no longer valid
-		cluster.Status.Proxy.PGBouncer.PostgreSQLRevision = ""
-		cluster.Status.Monitoring.ExporterConfiguration = ""
-		return nil
-	}
-
-	setPreparingClusterCondition("removing DCS")
-	// delete any Endpoints
-	for i := range currentEndpoints {
-		if err := r.Client.Delete(ctx, &currentEndpoints[i]); client.IgnoreNotFound(err) != nil {
-			return errors.WithStack(err)
+	// Confirm Patroni's DCS state has actually been cleared before proceeding to
+	// re-bootstrap. Under Kubernetes DCS this means the Endpoints Patroni created are
+	// gone; under an external DCS backend (e.g. etcd), Patroni never creates those
+	// Endpoints, so a Job running "patronictl remove" is used instead to clear the
+	// leader lock, members, and the "initialize" key from the external DCS (run only
+	// now, after Patroni is confirmed stopped, so there's no live Patroni process left
+	// to re-register itself into DCS).
+	if cluster.UsesExternalDCS() {
+		switch {
+		case dcsCleanupJob == nil:
+			setPreparingClusterCondition("removing DCS")
+			if err := r.reconcileDCSCleanupJob(ctx, cluster); err != nil {
+				return errors.WithStack(err)
+			}
+			return nil
+		case jobFailed(dcsCleanupJob):
+			setPreparingClusterCondition("removing DCS")
+			r.Recorder.Eventf(cluster, corev1.EventTypeWarning, "PatroniDCSCleanupFailed",
+				"patronictl remove failed; retrying")
+			if err := r.Client.Delete(ctx, dcsCleanupJob,
+				client.PropagationPolicy(metav1.DeletePropagationBackground)); err != nil {
+				return errors.WithStack(err)
+			}
+			return nil
+		case !jobCompleted(dcsCleanupJob):
+			// still running; wait for the next reconcile
+			return nil
 		}
+		// dcsCleanupJob completed successfully -- fall through to re-bootstrap below.
+	} else if len(currentEndpoints) > 0 {
+		setPreparingClusterCondition("removing DCS")
+		// delete any Endpoints
+		for i := range currentEndpoints {
+			if err := r.Client.Delete(ctx, &currentEndpoints[i]); client.IgnoreNotFound(err) != nil {
+				return errors.WithStack(err)
+			}
+		}
+		return nil
 	}
 
+	// everything is gone, proceed with re-bootstrapping the cluster via an in-place restore
+	meta.RemoveStatusCondition(&cluster.Status.Conditions, ConditionPostgresDataInitialized)
+	meta.SetStatusCondition(&cluster.Status.Conditions, metav1.Condition{
+		ObservedGeneration: cluster.GetGeneration(),
+		Type:               ConditionPGBackRestRestoreProgressing,
+		Status:             metav1.ConditionTrue,
+		Reason:             ReasonReadyForRestore,
+		Message:            "Restoring cluster in-place",
+	})
+	// the cluster is no longer bootstrapped
+	cluster.Status.Patroni.SystemIdentifier = ""
+	// the restore will change the contents of the database, so the pgbouncer and exporter hashes
+	// are no longer valid
+	cluster.Status.Proxy.PGBouncer.PostgreSQLRevision = ""
+	cluster.Status.Monitoring.ExporterConfiguration = ""
 	return nil
 }
 
@@ -1518,6 +1574,103 @@ func (r *Reconciler) generateRestoreJobIntent(cluster *v1beta1.PostgresCluster,
 	return nil
 }
 
+// reconcileDCSCleanupJob reconciles the Job that runs "patronictl remove" to clear
+// cluster's Patroni state from its external DCS before an in-place restore
+// re-bootstraps the cluster. Only used when cluster.UsesExternalDCS() (e.g. etcd).
+func (r *Reconciler) reconcileDCSCleanupJob(ctx context.Context, cluster *v1beta1.PostgresCluster) error {
+	clusterConfigMap := &corev1.ConfigMap{}
+	if err := r.Client.Get(ctx,
+		naming.AsObjectKey(naming.ClusterConfigMap(cluster)), clusterConfigMap); err != nil {
+		return errors.WithStack(err)
+	}
+
+	startupInstance := metav1.ObjectMeta{
+		Namespace: cluster.Namespace,
+		Name:      cluster.Status.StartupInstance,
+	}
+	instanceConfigMap := &corev1.ConfigMap{}
+	if err := r.Client.Get(ctx,
+		naming.AsObjectKey(naming.InstanceConfigMap(&startupInstance)), instanceConfigMap); err != nil {
+		return errors.WithStack(err)
+	}
+	instanceCertificates := &corev1.Secret{}
+	if err := r.Client.Get(ctx,
+		naming.AsObjectKey(naming.InstanceCertificates(&startupInstance)), instanceCertificates); err != nil {
+		return errors.WithStack(err)
+	}
+
+	job := &batchv1.Job{}
+	if err := r.generateDCSCleanupJobIntent(cluster,
+		clusterConfigMap, instanceConfigMap, instanceCertificates, job); err != nil {
+		return errors.WithStack(err)
+	}
+
+	return errors.WithStack(r.apply(ctx, job))
+}
+
+// generateDCSCleanupJobIntent generates the Job that runs "patronictl remove".
+func (r *Reconciler) generateDCSCleanupJobIntent(
+	cluster *v1beta1.PostgresCluster,
+	clusterConfigMap, instanceConfigMap *corev1.ConfigMap, instanceCertificates *corev1.Secret,
+	job *batchv1.Job,
+) error {
+	meta := naming.PatroniDCSCleanupJob(cluster)
+	labels := naming.Merge(
+		cluster.Spec.Metadata.GetLabelsOrNil(),
+		naming.WithPerconaLabels(
+			naming.PatroniDCSCleanupJobLabels(cluster.Name),
+			cluster.Name, "", cluster.Labels[naming.LabelVersion]),
+	)
+	meta.Labels = labels
+
+	// This Job is part of the in-place restore, so it reuses the restore's resources.
+	var resources corev1.ResourceRequirements
+	if restore := cluster.Spec.Backups.PGBackRest.Restore; restore != nil {
+		resources = restore.Resources
+	}
+
+	job.ObjectMeta = meta
+	job.Spec = batchv1.JobSpec{
+		// one attempt; prepareForRestore deletes and recreates the Job on failure
+		BackoffLimit: ptr.To(int32(0)),
+		Template: corev1.PodTemplateSpec{
+			ObjectMeta: metav1.ObjectMeta{
+				Labels: labels,
+			},
+			Spec: corev1.PodSpec{
+				Containers: []corev1.Container{{
+					Name:            naming.ContainerDatabase,
+					Image:           config.PostgresContainerImage(cluster),
+					ImagePullPolicy: cluster.Spec.ImagePullPolicy,
+					SecurityContext: initialize.RestrictedSecurityContext(cluster.CompareVersion("2.5.0") >= 0),
+					Resources:       resources,
+				}},
+				RestartPolicy:                corev1.RestartPolicyNever,
+				AutomountServiceAccountToken: new(false),
+				EnableServiceLinks:           new(false),
+				ImagePullSecrets:             cluster.Spec.ImagePullSecrets,
+				SecurityContext:              postgres.PodSecurityContext(cluster),
+			},
+		},
+	}
+
+	// This Job is part of the in-place restore, so it reuses the restore's
+	// scheduling configuration (affinity, tolerations, priorityClassName).
+	if restore := cluster.Spec.Backups.PGBackRest.Restore; restore != nil {
+		job.Spec.Template.Spec.Affinity = restore.Affinity
+		job.Spec.Template.Spec.Tolerations = restore.Tolerations
+		if restore.PriorityClassName != nil {
+			job.Spec.Template.Spec.PriorityClassName = *restore.PriorityClassName
+		}
+	}
+
+	patroni.DCSCleanupJob(cluster, clusterConfigMap, instanceConfigMap, instanceCertificates,
+		&job.Spec.Template)
+
+	job.SetGroupVersionKind(batchv1.SchemeGroupVersion.WithKind("Job"))
+	return errors.WithStack(r.setControllerReference(cluster, job))
+}
+
 // reconcilePGBackRest is responsible for reconciling any/all pgBackRest resources owned by a
 // specific PostgresCluster (e.g. Deployments, ConfigMaps, Secrets, etc.).  This function will
 // ensure various reconciliation logic is run as needed for each pgBackRest resource, while then
diff --git a/internal/controller/postgrescluster/pgbackrest_test.go b/internal/controller/postgrescluster/pgbackrest_test.go
index e41a11e83e..aa38f5dd8a 100644
--- a/internal/controller/postgrescluster/pgbackrest_test.go
+++ b/internal/controller/postgrescluster/pgbackrest_test.go
@@ -30,6 +30,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/rand"
 	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/tools/record"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
@@ -3791,7 +3792,7 @@ func TestObserveRestoreEnv(t *testing.T) {
 				cluster := fakePostgresCluster(clusterName, namespace, clusterUID, dedicated)
 				tc.createResources(t, cluster)
 
-				endpoints, job, err := r.observeRestoreEnv(ctx, cluster)
+				endpoints, job, _, err := r.observeRestoreEnv(ctx, cluster)
 				assert.NilError(t, err)
 
 				assert.Assert(t, tc.result.foundRestoreJob == (job != nil))
@@ -3809,6 +3810,84 @@ func TestObserveRestoreEnv(t *testing.T) {
 			})
 		}
 	}
+
+	t.Run("etcd DCS", func(t *testing.T) {
+		generateDCSCleanupJob := func(clusterName string, completed, failed *bool) *batchv1.Job {
+			cluster := &v1beta1.PostgresCluster{
+				ObjectMeta: metav1.ObjectMeta{Name: clusterName, Namespace: namespace},
+			}
+			meta := naming.PatroniDCSCleanupJob(cluster)
+			meta.Labels = naming.PatroniDCSCleanupJobLabels(cluster.Name)
+
+			job := &batchv1.Job{
+				ObjectMeta: meta,
+				Spec: batchv1.JobSpec{
+					Template: corev1.PodTemplateSpec{
+						ObjectMeta: meta,
+						Spec: corev1.PodSpec{
+							Containers:    []corev1.Container{{Image: "test", Name: naming.ContainerDatabase}},
+							RestartPolicy: corev1.RestartPolicyNever,
+						},
+					},
+				},
+				Status: batchv1.JobStatus{
+					StartTime: new(metav1.NewTime(time.Now().Add(-time.Minute))),
+				},
+			}
+			if completed != nil && *completed {
+				job.Status.CompletionTime = new(metav1.Now())
+				job.Status.Succeeded = 1
+				job.Status.Conditions = append(job.Status.Conditions, batchv1.JobCondition{
+					Type: batchv1.JobComplete, Status: corev1.ConditionTrue, Reason: "test", Message: "test",
+				})
+			}
+			if failed != nil && *failed {
+				job.Status.Conditions = append(job.Status.Conditions, batchv1.JobCondition{
+					Type: batchv1.JobFailed, Status: corev1.ConditionTrue, Reason: "test", Message: "test",
+				})
+			}
+			return job
+		}
+
+		testCases := []struct {
+			desc            string
+			createResources func(t *testing.T, cluster *v1beta1.PostgresCluster)
+			foundJob        bool
+		}{{
+			desc:            "no cleanup job exists",
+			createResources: func(t *testing.T, cluster *v1beta1.PostgresCluster) {},
+			foundJob:        false,
+		}, {
+			desc: "cleanup job exists",
+			createResources: func(t *testing.T, cluster *v1beta1.PostgresCluster) {
+				job := generateDCSCleanupJob(cluster.Name, nil, nil)
+				assert.NilError(t, r.Client.Create(ctx, job))
+			},
+			foundJob: true,
+		}}
+
+		for i, tc := range testCases {
+			t.Run(tc.desc, func(t *testing.T) {
+				clusterName := "observe-restore-env-etcd" + strconv.Itoa(i)
+				cluster := fakePostgresCluster(clusterName, namespace, clusterName, false)
+				cluster.Spec.Patroni = &v1beta1.PatroniSpec{
+					DCS: &v1beta1.PatroniDCS{
+						Type: v1beta1.PatroniDCSTypeEtcd,
+						Etcd: &v1beta1.PatroniEtcdSpec{Endpoints: []string{"http://etcd:2379"}},
+					},
+				}
+				tc.createResources(t, cluster)
+
+				endpoints, restoreJob, dcsCleanupJob, err := r.observeRestoreEnv(ctx, cluster)
+				assert.NilError(t, err)
+				// Under etcd DCS, Patroni never creates the k8s Endpoints objects, so this
+				// must stay empty regardless of the DCS cleanup Job's presence.
+				assert.Assert(t, len(endpoints) == 0)
+				assert.Assert(t, restoreJob == nil)
+				assert.Assert(t, tc.foundJob == (dcsCleanupJob != nil))
+			})
+		}
+	})
 }
 
 func TestPrepareForRestore(t *testing.T) {
@@ -3816,7 +3895,11 @@ func TestPrepareForRestore(t *testing.T) {
 	_, tClient := setupKubernetes(t)
 	require.ParallelCapacity(t, 1)
 
-	r := &Reconciler{Client: tClient, Owner: client.FieldOwner(t.Name())}
+	r := &Reconciler{
+		Client:   tClient,
+		Owner:    client.FieldOwner(t.Name()),
+		Recorder: record.NewFakeRecorder(10),
+	}
 	namespace := setupNamespace(t, tClient).Name
 
 	generateJob := func(clusterName string) *batchv1.Job {
@@ -3993,7 +4076,7 @@ func TestPrepareForRestore(t *testing.T) {
 					fakeObserved = tc.fakeObserved
 				}
 				assert.NilError(t, r.prepareForRestore(ctx, cluster, fakeObserved, endpoints,
-					job, restoreID))
+					job, nil, restoreID))
 
 				var primaryInstance *Instance
 				for i, instance := range fakeObserved.forCluster {
@@ -4059,6 +4142,149 @@ func TestPrepareForRestore(t *testing.T) {
 			})
 		}
 	}
+
+	t.Run("etcd DCS", func(t *testing.T) {
+		generateDCSCleanupJob := func(clusterName string, completed, failed *bool) *batchv1.Job {
+			cluster := &v1beta1.PostgresCluster{
+				ObjectMeta: metav1.ObjectMeta{Name: clusterName, Namespace: namespace},
+			}
+			jobMeta := naming.PatroniDCSCleanupJob(cluster)
+			jobMeta.Labels = naming.PatroniDCSCleanupJobLabels(cluster.Name)
+
+			job := &batchv1.Job{
+				ObjectMeta: jobMeta,
+				Spec: batchv1.JobSpec{
+					Template: corev1.PodTemplateSpec{
+						ObjectMeta: jobMeta,
+						Spec: corev1.PodSpec{
+							Containers:    []corev1.Container{{Image: "test", Name: naming.ContainerDatabase}},
+							RestartPolicy: corev1.RestartPolicyNever,
+						},
+					},
+				},
+			}
+			if completed != nil && *completed {
+				job.Status.CompletionTime = new(metav1.Now())
+				job.Status.Succeeded = 1
+				job.Status.Conditions = append(job.Status.Conditions, batchv1.JobCondition{
+					Type: batchv1.JobComplete, Status: corev1.ConditionTrue, Reason: "test", Message: "test",
+				})
+			}
+			if failed != nil && *failed {
+				job.Status.Conditions = append(job.Status.Conditions, batchv1.JobCondition{
+					Type: batchv1.JobFailed, Status: corev1.ConditionTrue, Reason: "test", Message: "test",
+				})
+			}
+			return job
+		}
+
+		newEtcdCluster := func(clusterName string) *v1beta1.PostgresCluster {
+			cluster := fakePostgresCluster(clusterName, namespace, clusterName, false)
+			cluster.Spec.Patroni = &v1beta1.PatroniSpec{
+				DCS: &v1beta1.PatroniDCS{
+					Type: v1beta1.PatroniDCSTypeEtcd,
+					Etcd: &v1beta1.PatroniEtcdSpec{Endpoints: []string{"http://etcd:2379"}},
+				},
+			}
+			cluster.Status.Patroni = v1beta1.PatroniStatus{SystemIdentifier: "abcde12345"}
+			cluster.Status.Proxy.PGBouncer.PostgreSQLRevision = "abcde12345"
+			cluster.Status.Monitoring.ExporterConfiguration = "abcde12345"
+			meta.SetStatusCondition(&cluster.Status.Conditions, metav1.Condition{
+				ObservedGeneration: cluster.GetGeneration(),
+				Type:               ConditionPostgresDataInitialized,
+				Status:             metav1.ConditionTrue,
+				Reason:             "PGBackRestRestoreComplete",
+				Message:            "pgBackRest restore completed successfully",
+			})
+			return cluster
+		}
+
+		t.Run("no cleanup job creates one", func(t *testing.T) {
+			cluster := newEtcdCluster("prepare-restore-etcd-create")
+			startupInstanceName := naming.GenerateStartupInstance(cluster, &cluster.Spec.InstanceSets[0]).Name
+			assert.NilError(t, r.Client.Create(ctx, &corev1.ConfigMap{ObjectMeta: naming.ClusterConfigMap(cluster)}))
+			instanceMeta := metav1.ObjectMeta{Namespace: namespace, Name: startupInstanceName}
+			assert.NilError(t, r.Client.Create(ctx,
+				&corev1.ConfigMap{ObjectMeta: naming.InstanceConfigMap(&instanceMeta)}))
+			assert.NilError(t, r.Client.Create(ctx,
+				&corev1.Secret{ObjectMeta: naming.InstanceCertificates(&instanceMeta)}))
+
+			fakeObserved := &observedInstances{forCluster: []*Instance{}}
+			assert.NilError(t, r.prepareForRestore(ctx, cluster, fakeObserved, nil, nil, nil, "test-restore-id"))
+
+			assert.NilError(t, r.Client.Get(ctx,
+				naming.AsObjectKey(naming.PatroniDCSCleanupJob(cluster)), &batchv1.Job{}))
+
+			condition := meta.FindStatusCondition(cluster.Status.Conditions, ConditionPGBackRestRestoreProgressing)
+			if assert.Check(t, condition != nil) {
+				assert.Equal(t, condition.Message, "Preparing cluster to restore in-place: removing DCS")
+			}
+			assert.Assert(t, meta.FindStatusCondition(cluster.Status.Conditions,
+				ConditionPostgresDataInitialized) != nil)
+		})
+
+		t.Run("failed cleanup job is deleted", func(t *testing.T) {
+			cluster := newEtcdCluster("prepare-restore-etcd-failed")
+			job := generateDCSCleanupJob(cluster.Name, nil, new(true))
+			// Client.Create strips the Status subresource from job; keep a copy
+			// with the failed condition to pass in, as observeRestoreEnv's List
+			// would return in production.
+			jobWithStatus := job.DeepCopy()
+			assert.NilError(t, r.Client.Create(ctx, job))
+
+			fakeObserved := &observedInstances{forCluster: []*Instance{}}
+			assert.NilError(t, r.prepareForRestore(ctx, cluster, fakeObserved, nil, nil, jobWithStatus, "test-restore-id"))
+
+			err := r.Client.Get(ctx, naming.AsObjectKey(naming.PatroniDCSCleanupJob(cluster)), &batchv1.Job{})
+			assert.Assert(t, apierrors.IsNotFound(err))
+
+			condition := meta.FindStatusCondition(cluster.Status.Conditions, ConditionPGBackRestRestoreProgressing)
+			if assert.Check(t, condition != nil) {
+				assert.Equal(t, condition.Message, "Preparing cluster to restore in-place: removing DCS")
+			}
+			assert.Assert(t, meta.FindStatusCondition(cluster.Status.Conditions,
+				ConditionPostgresDataInitialized) != nil)
+		})
+
+		t.Run("running cleanup job waits", func(t *testing.T) {
+			cluster := newEtcdCluster("prepare-restore-etcd-running")
+			job := generateDCSCleanupJob(cluster.Name, nil, nil)
+			assert.NilError(t, r.Client.Create(ctx, job))
+
+			fakeObserved := &observedInstances{forCluster: []*Instance{}}
+			assert.NilError(t, r.prepareForRestore(ctx, cluster, fakeObserved, nil, nil, job, "test-restore-id"))
+
+			// the Job is left alone and the cluster is not bootstrapped yet
+			assert.NilError(t, r.Client.Get(ctx,
+				naming.AsObjectKey(naming.PatroniDCSCleanupJob(cluster)), &batchv1.Job{}))
+			assert.Assert(t, meta.FindStatusCondition(cluster.Status.Conditions,
+				ConditionPostgresDataInitialized) != nil)
+		})
+
+		t.Run("completed cleanup job triggers bootstrap", func(t *testing.T) {
+			cluster := newEtcdCluster("prepare-restore-etcd-completed")
+			job := generateDCSCleanupJob(cluster.Name, new(true), nil)
+			// Client.Create strips the Status subresource from job; keep a copy
+			// with the completed condition to pass in, as observeRestoreEnv's List
+			// would return in production.
+			jobWithStatus := job.DeepCopy()
+			assert.NilError(t, r.Client.Create(ctx, job))
+
+			fakeObserved := &observedInstances{forCluster: []*Instance{}}
+			assert.NilError(t, r.prepareForRestore(ctx, cluster, fakeObserved, nil, nil, jobWithStatus, "test-restore-id"))
+
+			condition := meta.FindStatusCondition(cluster.Status.Conditions, ConditionPGBackRestRestoreProgressing)
+			if assert.Check(t, condition != nil) {
+				assert.Equal(t, condition.Reason, ReasonReadyForRestore)
+				assert.Equal(t, condition.Message, "Restoring cluster in-place")
+			}
+			assert.Assert(t, cluster.Status.Patroni.SystemIdentifier == "")
+			assert.Assert(t, cluster.Status.Proxy.PGBouncer.PostgreSQLRevision == "")
+			assert.Assert(t, cluster.Status.Monitoring.ExporterConfiguration == "")
+			assert.Assert(t, meta.FindStatusCondition(cluster.Status.Conditions,
+				ConditionPostgresDataInitialized) == nil)
+		})
+	})
 }
 
 func TestReconcileScheduledBackups(t *testing.T) {
diff --git a/internal/naming/labels.go b/internal/naming/labels.go
index ad67a6bc9c..91f4a2f15f 100644
--- a/internal/naming/labels.go
+++ b/internal/naming/labels.go
@@ -81,6 +81,11 @@ const (
 	// resource (e.g. a ConfigMap or Secret) is for a pgBackRest restore
 	LabelPGBackRestRestoreConfig = labelPrefix + "pgbackrest-restore-config"
 
+	// LabelPatroniDCSCleanup is used to indicate that a Job removes cluster's
+	// Patroni state from an external DCS backend (e.g. etcd) prior to an
+	// in-place restore.
+	LabelPatroniDCSCleanup = labelPrefix + "patroni-dcs-cleanup"
+
 	// LabelPGMonitorDiscovery is the label added to Pods running the "exporter" container to
 	// support discovery by Prometheus according to pgMonitor configuration
 	LabelPGMonitorDiscovery = labelPrefix + "crunchy-postgres-exporter"
@@ -248,6 +253,22 @@ func PGBackRestRestoreJobSelector(clusterName string) labels.Selector {
 	return PGBackRestRestoreJobLabels(clusterName).AsSelector()
 }
 
+// PatroniDCSCleanupJobLabels provides labels for the Job that runs
+// "patronictl remove" to clear cluster's Patroni state from the configured external DCS (e.g. etcd)
+func PatroniDCSCleanupJobLabels(clusterName string) labels.Set {
+	commonLabels := map[string]string{LabelCluster: clusterName}
+	jobLabels := map[string]string{
+		LabelPatroniDCSCleanup: "",
+	}
+	return labels.Merge(jobLabels, commonLabels)
+}
+
+// PatroniDCSCleanupJobSelector provides selector for querying the Patroni DCS
+// cleanup Job.
+func PatroniDCSCleanupJobSelector(clusterName string) labels.Selector {
+	return PatroniDCSCleanupJobLabels(clusterName).AsSelector()
+}
+
 // PGBackRestRepoLabels provides common labels for pgBackRest repository
 // resources.
 func PGBackRestRepoLabels(clusterName, repoName string) labels.Set {
diff --git a/internal/naming/names.go b/internal/naming/names.go
index cca81200ef..0f91c7185e 100644
--- a/internal/naming/names.go
+++ b/internal/naming/names.go
@@ -433,6 +433,16 @@ func PatroniLeaderEndpoints(cluster *v1beta1.PostgresCluster) metav1.ObjectMeta
 	}
 }
 
+// PatroniDCSCleanupJob returns the ObjectMeta for the Job that runs
+// "patronictl remove" to clear cluster's Patroni state from an external DCS
+// (e.g. etcd) before an in-place restore re-bootstraps the cluster.
+func PatroniDCSCleanupJob(cluster *v1beta1.PostgresCluster) metav1.ObjectMeta {
+	return metav1.ObjectMeta{
+		Namespace: cluster.GetNamespace(),
+		Name:      cluster.Name + "-patroni-dcs-cleanup",
+	}
+}
+
 // PatroniScope returns the "scope" Patroni uses for cluster.
 func PatroniScope(cluster *v1beta1.PostgresCluster) string {
 	return cluster.Name + "-ha"
diff --git a/internal/patroni/api.go b/internal/patroni/api.go
index 9375337a73..6a4baca848 100644
--- a/internal/patroni/api.go
+++ b/internal/patroni/api.go
@@ -8,7 +8,9 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
+	"path"
 	"strings"
 
 	"github.com/pkg/errors"
@@ -176,6 +178,52 @@ func (exec Executor) RestartPendingMembers(ctx context.Context, role, scope stri
 	return err
 }
 
+// MemberStatus mirrors the fields PGO needs from Patroni's monitoring
+// endpoint (GET /patroni), available on every Patroni instance regardless
+// of DCS backend.
+// - https://github.com/patroni/patroni/blob/v4.1.4/docs/rest_api.rst#monitoring-endpoint
+type MemberStatus struct {
+	DatabaseSystemIdentifier string `json:"database_system_identifier"`
+	PendingRestart           bool   `json:"pending_restart"`
+}
+
+// GetMemberStatus curls Patroni's own monitoring REST endpoint inside the
+// pod and returns the parsed response. Unlike reading Kubernetes annotations,
+// this works identically regardless of DCS backend, since it's
+// PostgreSQL/Patroni introspection rather than a DCS read.
+//
+// host must match a DNS SAN on Patroni's REST API certificate (i.e. the
+// pod's own stable DNS name) since Patroni does not certify "localhost".
+func (exec Executor) GetMemberStatus(ctx context.Context, host string, port int32) (MemberStatus, error) {
+	var stdout, stderr bytes.Buffer
+	var status MemberStatus
+
+	err := exec(ctx, nil, &stdout, &stderr,
+		"curl", "--silent", "--fail",
+		"--cacert", path.Join(configDirectory, certAuthorityConfigPath),
+		fmt.Sprintf("https://%s:%d/patroni", host, port))
+	if err != nil {
+		return status, err
+	}
+
+	if stderr.String() != "" {
+		return status, errors.New(stderr.String())
+	}
+
+	err = json.Unmarshal(stdout.Bytes(), &status)
+	return status, err
+}
+
+// PodRequiresRestart returns whether or not PostgreSQL inside the pod has
+// (pending) parameter changes that require a PostgreSQL restart, by asking
+// Patroni's own monitoring REST API directly. Unlike the package-level
+// PodRequiresRestart function, this works under any DCS backend, since it
+// doesn't depend on Patroni having written a Kubernetes annotation.
+func (exec Executor) PodRequiresRestart(ctx context.Context, host string, port int32) (bool, error) {
+	status, err := exec.GetMemberStatus(ctx, host, port)
+	return status.PendingRestart, err
+}
+
 // GetTimeline gets the patronictl status and returns the timeline,
 // currently the only information required by PGO.
 // Returns zero if it runs into errors or cannot find a running Leader pod
diff --git a/internal/patroni/api_test.go b/internal/patroni/api_test.go
index d2a2c30790..03579b1e39 100644
--- a/internal/patroni/api_test.go
+++ b/internal/patroni/api_test.go
@@ -287,3 +287,99 @@ func TestExecutorGetTimeline(t *testing.T) {
 		assert.Equal(t, tl, int64(4))
 	})
 }
+
+func TestExecutorGetMemberStatus(t *testing.T) {
+	t.Run("Error", func(t *testing.T) {
+		expected := errors.New("bang")
+		status, actual := Executor(func(
+			context.Context, io.Reader, io.Writer, io.Writer, ...string,
+		) error {
+			return expected
+		}).GetMemberStatus(context.Background(), "some-host", 8008)
+
+		assert.Equal(t, expected, actual)
+		assert.DeepEqual(t, status, MemberStatus{})
+	})
+
+	t.Run("Stderr", func(t *testing.T) {
+		status, actual := Executor(func(
+			_ context.Context, stdin io.Reader, stdout, stderr io.Writer, command ...string,
+		) error {
+			_, _ = stderr.Write([]byte(`no luck`))
+			return nil
+		}).GetMemberStatus(context.Background(), "some-host", 8008)
+
+		assert.Error(t, actual, "no luck")
+		assert.DeepEqual(t, status, MemberStatus{})
+	})
+
+	t.Run("BadJSON", func(t *testing.T) {
+		status, actual := Executor(func(
+			_ context.Context, stdin io.Reader, stdout, stderr io.Writer, command ...string,
+		) error {
+			_, _ = stdout.Write([]byte(`no luck`))
+			return nil
+		}).GetMemberStatus(context.Background(), "some-host", 8008)
+
+		assert.ErrorContains(t, actual, "invalid character")
+		assert.DeepEqual(t, status, MemberStatus{})
+	})
+
+	t.Run("Success", func(t *testing.T) {
+		status, actual := Executor(func(
+			_ context.Context, stdin io.Reader, stdout, stderr io.Writer, command ...string,
+		) error {
+			assert.DeepEqual(t, command, strings.Fields(
+				`curl --silent --fail --cacert /etc/patroni/~postgres-operator/patroni.ca-roots https://some-host:8008/patroni`,
+			))
+			assert.Assert(t, stdin == nil, "expected no stdin, got %T", stdin)
+
+			_, _ = stdout.Write([]byte(
+				`{"state": "running", "role": "primary", "database_system_identifier": "6287881213849985952", "pending_restart": true}`,
+			))
+			return nil
+		}).GetMemberStatus(context.Background(), "some-host", 8008)
+
+		assert.NilError(t, actual)
+		assert.Equal(t, status.DatabaseSystemIdentifier, "6287881213849985952")
+		assert.Equal(t, status.PendingRestart, true)
+	})
+}
+
+func TestExecutorPodRequiresRestart(t *testing.T) {
+	t.Run("Error", func(t *testing.T) {
+		expected := errors.New("bang")
+		restart, actual := Executor(func(
+			context.Context, io.Reader, io.Writer, io.Writer, ...string,
+		) error {
+			return expected
+		}).PodRequiresRestart(context.Background(), "some-host", 8008)
+
+		assert.Equal(t, expected, actual)
+		assert.Equal(t, restart, false)
+	})
+
+	t.Run("False", func(t *testing.T) {
+		restart, actual := Executor(func(
+			_ context.Context, stdin io.Reader, stdout, stderr io.Writer, command ...string,
+		) error {
+			_, _ = stdout.Write([]byte(`{"state": "running", "pending_restart": false}`))
+			return nil
+		}).PodRequiresRestart(context.Background(), "some-host", 8008)
+
+		assert.NilError(t, actual)
+		assert.Equal(t, restart, false)
+	})
+
+	t.Run("True", func(t *testing.T) {
+		restart, actual := Executor(func(
+			_ context.Context, stdin io.Reader, stdout, stderr io.Writer, command ...string,
+		) error {
+			_, _ = stdout.Write([]byte(`{"state": "running", "pending_restart": true}`))
+			return nil
+		}).PodRequiresRestart(context.Background(), "some-host", 8008)
+
+		assert.NilError(t, actual)
+		assert.Equal(t, restart, true)
+	})
+}
diff --git a/internal/patroni/config.go b/internal/patroni/config.go
index 64752d08d0..b89eac1fd8 100644
--- a/internal/patroni/config.go
+++ b/internal/patroni/config.go
@@ -7,6 +7,7 @@ package patroni
 import (
 	"fmt"
 	"maps"
+	"net/url"
 	"path"
 	"strings"
 
@@ -36,6 +37,33 @@ const (
 		"# If you want to override the config, annotate this ConfigMap with " + naming.OverrideConfigAnnotation + "=true\n"
 )
 
+// etcdHosts strips the URL scheme from each endpoint and returns bare host:port strings.
+func etcdHosts(endpoints []string) []string {
+	hosts := make([]string, 0, len(endpoints))
+	for _, ep := range endpoints {
+		u, err := url.Parse(ep)
+		if err != nil || u.Host == "" {
+			hosts = append(hosts, ep)
+			continue
+		}
+		hosts = append(hosts, u.Host)
+	}
+	return hosts
+}
+
+// etcdProtocol returns the URL scheme of the first endpoint ("http" or "https").
+// Defaults to "http" when the scheme cannot be determined.
+func etcdProtocol(endpoints []string) string {
+	if len(endpoints) == 0 {
+		return "http"
+	}
+	u, err := url.Parse(endpoints[0])
+	if err != nil || (u.Scheme != "http" && u.Scheme != "https") {
+		return "http"
+	}
+	return u.Scheme
+}
+
 // quoteShellWord ensures that s is interpreted by a shell as single word.
 func quoteShellWord(s string) string {
 	// https://www.gnu.org/software/bash/manual/html_node/Quoting.html
@@ -48,33 +76,11 @@ func clusterYAML(
 	pgHBAs postgres.HBAs, pgParameters postgres.Parameters,
 ) (string, error) {
 
-	labels := map[string]string{naming.LabelCluster: cluster.Name}
-	if cluster.CompareVersion("2.9.0") >= 0 {
-		labels = naming.Merge(cluster.Spec.Metadata.GetLabelsOrNil(), labels)
-	}
-
 	root := map[string]any{
 		// The cluster identifier. This value cannot change during the cluster's
 		// lifetime.
 		"scope": naming.PatroniScope(cluster),
 
-		// Use Kubernetes Endpoints for the distributed configuration store (DCS).
-		// These values cannot change during the cluster's lifetime.
-		//
-		// NOTE(cbandy): It *might* be possible to *carefully* change the role and
-		// scope labels, but there is no way to reconfigure all instances at once.
-		"kubernetes": map[string]any{
-			"namespace":     cluster.Namespace,
-			"role_label":    naming.LabelRole,
-			"scope_label":   naming.LabelPatroni,
-			"use_endpoints": true,
-
-			// In addition to "scope_label" above, Patroni will add the following to
-			// every object it creates. It will also use these as filters when doing
-			// any lookups.
-			"labels": labels,
-		},
-
 		"postgresql": map[string]any{
 			// TODO(cbandy): "callbacks"
 
@@ -158,6 +164,52 @@ func clusterYAML(
 		},
 	}
 
+	// DCS configuration — either external etcd or the Kubernetes-native Endpoints backend.
+	// These values cannot change during the cluster's lifetime.
+	if cluster.DCSType() == v1beta1.PatroniDCSTypeEtcd {
+		if dcs := cluster.GetDCS(); dcs.Etcd != nil {
+			etcd3 := map[string]any{
+				"hosts":    etcdHosts(dcs.Etcd.Endpoints),
+				"protocol": etcdProtocol(dcs.Etcd.Endpoints),
+			}
+			if dcs.Etcd.TLSSecret != "" {
+				etcd3["cacert"] = path.Join(configDirectory, "etcd-tls", "ca.crt")
+				etcd3["cert"] = path.Join(configDirectory, "etcd-tls", "tls.crt")
+				etcd3["key"] = path.Join(configDirectory, "etcd-tls", "tls.key")
+			}
+			root["etcd3"] = etcd3
+
+			// With etcd DCS, Patroni does not update pod labels. Use callbacks to
+			// patch the role label on start and on each role change so Service
+			// selectors keep working. on_start covers pod restarts where the role
+			// does not change; on_role_change covers failovers.
+			root["postgresql"].(map[string]any)["callbacks"] = map[string]any{
+				"on_start":       "/opt/crunchy/bin/patroni-role-change.sh",
+				"on_role_change": "/opt/crunchy/bin/patroni-role-change.sh",
+			}
+		}
+	} else {
+		// Use Kubernetes Endpoints for the distributed configuration store (DCS).
+		//
+		// NOTE(cbandy): It *might* be possible to *carefully* change the role and
+		// scope labels, but there is no way to reconfigure all instances at once.
+		labels := map[string]string{naming.LabelCluster: cluster.Name}
+		if cluster.CompareVersion("2.9.0") >= 0 {
+			labels = naming.Merge(cluster.Spec.Metadata.GetLabelsOrNil(), labels)
+		}
+		root["kubernetes"] = map[string]any{
+			"namespace":     cluster.Namespace,
+			"role_label":    naming.LabelRole,
+			"scope_label":   naming.LabelPatroni,
+			"use_endpoints": true,
+
+			// In addition to "scope_label" above, Patroni will add the following to
+			// every object it creates. It will also use these as filters when doing
+			// any lookups.
+			"labels": labels,
+		}
+	}
+
 	if !ClusterBootstrapped(cluster) {
 		// Patroni has not yet bootstrapped. Populate the "bootstrap.dcs" field to
 		// facilitate it. When Patroni is already bootstrapped, this field is ignored.
@@ -348,17 +400,20 @@ func instanceEnvironment(
 	)
 
 	// Gather Endpoint ports for any Container ports that match the leader
-	// Service definition.
+	// Service definition. leaderService is nil when using etcd DCS (no k8s
+	// leader Endpoints), in which case the ports list stays empty.
 	ports := []corev1.EndpointPort{}
-	for _, sp := range leaderService.Spec.Ports {
-		for i := range podContainers {
-			for _, cp := range podContainers[i].Ports {
-				if sp.TargetPort.StrVal == cp.Name {
-					ports = append(ports, corev1.EndpointPort{
-						Name:     sp.Name,
-						Port:     cp.ContainerPort,
-						Protocol: cp.Protocol,
-					})
+	if leaderService != nil {
+		for _, sp := range leaderService.Spec.Ports {
+			for i := range podContainers {
+				for _, cp := range podContainers[i].Ports {
+					if sp.TargetPort.StrVal == cp.Name {
+						ports = append(ports, corev1.EndpointPort{
+							Name:     sp.Name,
+							Port:     cp.ContainerPort,
+							Protocol: cp.Protocol,
+						})
+					}
 				}
 			}
 		}
@@ -371,7 +426,7 @@ func instanceEnvironment(
 	// - https://github.com/zalando/patroni/blob/v2.0.2/patroni/postgresql/postmaster.py#L215-L216
 
 	variables := []corev1.EnvVar{
-		// Set "name" to the v1.Pod's name. Required when using Kubernetes for DCS.
+		// Set "name" to the v1.Pod's name. Required by Patroni for node identity.
 		// Patroni must be restarted when changing this value.
 		{
 			Name: "PATRONI_NAME",
@@ -380,31 +435,38 @@ func instanceEnvironment(
 				FieldPath:  "metadata.name",
 			}},
 		},
+	}
 
-		// Set "kubernetes.pod_ip" to the v1.Pod's primary IP address.
-		// Patroni must be restarted when changing this value.
-		{
-			Name: "PATRONI_KUBERNETES_POD_IP",
-			ValueFrom: &corev1.EnvVarSource{FieldRef: &corev1.ObjectFieldSelector{
-				APIVersion: "v1",
-				FieldPath:  "status.podIP",
-			}},
-		},
+	// The PATRONI_KUBERNETES_* variables are only needed for the Kubernetes DCS backend.
+	if !cluster.UsesExternalDCS() {
+		variables = append(variables,
+			// Set "kubernetes.pod_ip" to the v1.Pod's primary IP address.
+			// Patroni must be restarted when changing this value.
+			corev1.EnvVar{
+				Name: "PATRONI_KUBERNETES_POD_IP",
+				ValueFrom: &corev1.EnvVarSource{FieldRef: &corev1.ObjectFieldSelector{
+					APIVersion: "v1",
+					FieldPath:  "status.podIP",
+				}},
+			},
 
-		// When using Endpoints for DCS, Patroni needs to replicate the leader
-		// ServicePort definitions. Set "kubernetes.ports" to the YAML of this
-		// Pod's equivalent EndpointPort definitions.
-		//
-		// This is connascent with PATRONI_POSTGRESQL_CONNECT_ADDRESS below.
-		// Patroni must be restarted when changing this value.
-		{
-			Name:  "PATRONI_KUBERNETES_PORTS",
-			Value: string(portsYAML),
-		},
+			// When using Endpoints for DCS, Patroni needs to replicate the leader
+			// ServicePort definitions. Set "kubernetes.ports" to the YAML of this
+			// Pod's equivalent EndpointPort definitions.
+			//
+			// This is connascent with PATRONI_POSTGRESQL_CONNECT_ADDRESS below.
+			// Patroni must be restarted when changing this value.
+			corev1.EnvVar{
+				Name:  "PATRONI_KUBERNETES_PORTS",
+				Value: string(portsYAML),
+			},
+		)
+	}
 
+	variables = append(variables,
 		// Set "postgresql.connect_address" using the Pod's stable DNS name.
 		// PostgreSQL must be restarted when changing this value.
-		{
+		corev1.EnvVar{
 			Name:  "PATRONI_POSTGRESQL_CONNECT_ADDRESS",
 			Value: fmt.Sprintf("%s.%s:%d", "$(PATRONI_NAME)", podSubdomain, postgresPort),
 		},
@@ -414,28 +476,28 @@ func instanceEnvironment(
 		//
 		// This is connascent with PATRONI_POSTGRESQL_CONNECT_ADDRESS above.
 		// PostgreSQL must be restarted when changing this value.
-		{
+		corev1.EnvVar{
 			Name:  "PATRONI_POSTGRESQL_LISTEN",
 			Value: fmt.Sprintf("*:%d", postgresPort),
 		},
 
 		// Set "postgresql.config_dir" to PostgreSQL's $PGDATA directory.
 		// Patroni must be restarted when changing this value.
-		{
+		corev1.EnvVar{
 			Name:  "PATRONI_POSTGRESQL_CONFIG_DIR",
 			Value: postgres.ConfigDirectory(cluster),
 		},
 
 		// Set "postgresql.data_dir" to PostgreSQL's "data_directory".
 		// Patroni must be restarted when changing this value.
-		{
+		corev1.EnvVar{
 			Name:  "PATRONI_POSTGRESQL_DATA_DIR",
 			Value: postgres.DataDirectory(cluster),
 		},
 
 		// Set "restapi.connect_address" using the Pod's stable DNS name.
 		// Patroni must be reloaded when changing this value.
-		{
+		corev1.EnvVar{
 			Name:  "PATRONI_RESTAPI_CONNECT_ADDRESS",
 			Value: fmt.Sprintf("%s.%s:%d", "$(PATRONI_NAME)", podSubdomain, patroniPort),
 		},
@@ -443,17 +505,17 @@ func instanceEnvironment(
 		// Set "restapi.listen" using the special address "*" to mean all TCP interfaces.
 		// This is connascent with PATRONI_RESTAPI_CONNECT_ADDRESS above.
 		// Patroni must be reloaded when changing this value.
-		{
+		corev1.EnvVar{
 			Name:  "PATRONI_RESTAPI_LISTEN",
 			Value: fmt.Sprintf("*:%d", patroniPort),
 		},
 
 		// The Patroni client `patronictl` looks here for its configuration file(s).
-		{
+		corev1.EnvVar{
 			Name:  "PATRONICTL_CONFIG_FILE",
 			Value: configDirectory,
 		},
-	}
+	)
 
 	return variables
 }
@@ -497,15 +559,6 @@ func instanceYAML(
 		// created. That value should be injected using the downward API and the
 		// PATRONI_NAME environment variable.
 
-		"kubernetes": map[string]any{
-			// Missing here is "pod_ip" which cannot be known until the instance Pod is
-			// created. That value should be injected using the downward API and the
-			// PATRONI_KUBERNETES_POD_IP environment variable.
-
-			// Missing here is "ports" which is is connascent with "postgresql.connect_address".
-			// See the PATRONI_KUBERNETES_PORTS env variable.
-		},
-
 		"restapi": map[string]any{
 			// Missing here is "connect_address" which cannot be known until the
 			// instance Pod is created. That value should be injected using the downward
@@ -521,6 +574,19 @@ func instanceYAML(
 		},
 	}
 
+	// For the Kubernetes DCS backend, include an empty kubernetes section that
+	// receives pod_ip and ports from the PATRONI_KUBERNETES_* environment variables.
+	if !cluster.UsesExternalDCS() {
+		root["kubernetes"] = map[string]any{
+			// Missing here is "pod_ip" which cannot be known until the instance Pod is
+			// created. That value should be injected using the downward API and the
+			// PATRONI_KUBERNETES_POD_IP environment variable.
+
+			// Missing here is "ports" which is connascent with "postgresql.connect_address".
+			// See the PATRONI_KUBERNETES_PORTS env variable.
+		}
+	}
+
 	postgresql := map[string]any{
 		// TODO(cbandy): "bin_dir"
 
diff --git a/internal/patroni/config_test.go b/internal/patroni/config_test.go
index 8598ca58f6..467a00684a 100644
--- a/internal/patroni/config_test.go
+++ b/internal/patroni/config_test.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 
@@ -252,6 +253,227 @@ watchdog:
   mode: "off"
 	`)+"\n")
 	})
+
+	t.Run("etcd DCS - minimal", func(t *testing.T) {
+		cluster := new(v1beta1.PostgresCluster)
+		assert.NilError(t, cluster.Default(context.Background(), nil))
+		cluster.Namespace = "some-namespace"
+		cluster.Name = "cluster-name"
+		cluster.Spec.Patroni = &v1beta1.PatroniSpec{
+			DCS: &v1beta1.PatroniDCS{
+				Type: v1beta1.PatroniDCSTypeEtcd,
+				Etcd: &v1beta1.PatroniEtcdSpec{
+					Endpoints: []string{"https://etcd.etcd-cluster.svc:2379"},
+				},
+			},
+		}
+		cluster.Spec.Patroni.Default()
+
+		data, err := clusterYAML(cluster, postgres.HBAs{}, postgres.Parameters{})
+		assert.NilError(t, err)
+
+		var parsed map[string]any
+		assert.NilError(t, yaml.Unmarshal([]byte(data), &parsed))
+
+		_, hasKubernetes := parsed["kubernetes"]
+		assert.Assert(t, !hasKubernetes, "expected no kubernetes section for etcd DCS")
+
+		etcd3, ok := parsed["etcd3"].(map[string]any)
+		assert.Assert(t, ok, "expected etcd3 section")
+		assert.Equal(t, etcd3["protocol"], "https")
+
+		hosts, ok := etcd3["hosts"].([]any)
+		assert.Assert(t, ok, "expected etcd3.hosts to be a list")
+		assert.Equal(t, len(hosts), 1)
+		assert.Equal(t, hosts[0], "etcd.etcd-cluster.svc:2379")
+
+		_, hasCacert := etcd3["cacert"]
+		assert.Assert(t, !hasCacert, "expected no cacert without tlsSecret")
+		_, hasUsername := etcd3["username"]
+		assert.Assert(t, !hasUsername, "expected no username in etcd3 section")
+		_, hasPassword := etcd3["password"]
+		assert.Assert(t, !hasPassword, "expected no password in etcd3 section")
+	})
+
+	t.Run("etcd DCS - http protocol", func(t *testing.T) {
+		cluster := new(v1beta1.PostgresCluster)
+		assert.NilError(t, cluster.Default(context.Background(), nil))
+		cluster.Namespace = "some-namespace"
+		cluster.Name = "cluster-name"
+		cluster.Spec.Patroni = &v1beta1.PatroniSpec{
+			DCS: &v1beta1.PatroniDCS{
+				Type: v1beta1.PatroniDCSTypeEtcd,
+				Etcd: &v1beta1.PatroniEtcdSpec{
+					Endpoints: []string{"http://etcd:2379"},
+				},
+			},
+		}
+		cluster.Spec.Patroni.Default()
+
+		data, err := clusterYAML(cluster, postgres.HBAs{}, postgres.Parameters{})
+		assert.NilError(t, err)
+
+		var parsed map[string]any
+		assert.NilError(t, yaml.Unmarshal([]byte(data), &parsed))
+
+		etcd3, ok := parsed["etcd3"].(map[string]any)
+		assert.Assert(t, ok, "expected etcd3 section")
+		assert.Equal(t, etcd3["protocol"], "http")
+
+		hosts, ok := etcd3["hosts"].([]any)
+		assert.Assert(t, ok, "expected etcd3.hosts to be a list")
+		assert.Equal(t, hosts[0], "etcd:2379")
+	})
+
+	t.Run("etcd DCS - with TLS", func(t *testing.T) {
+		cluster := new(v1beta1.PostgresCluster)
+		assert.NilError(t, cluster.Default(context.Background(), nil))
+		cluster.Namespace = "some-namespace"
+		cluster.Name = "cluster-name"
+		cluster.Spec.Patroni = &v1beta1.PatroniSpec{
+			DCS: &v1beta1.PatroniDCS{
+				Type: v1beta1.PatroniDCSTypeEtcd,
+				Etcd: &v1beta1.PatroniEtcdSpec{
+					Endpoints: []string{"https://etcd:2379"},
+					TLSSecret: "etcd-tls",
+				},
+			},
+		}
+		cluster.Spec.Patroni.Default()
+
+		data, err := clusterYAML(cluster, postgres.HBAs{}, postgres.Parameters{})
+		assert.NilError(t, err)
+
+		var parsed map[string]any
+		assert.NilError(t, yaml.Unmarshal([]byte(data), &parsed))
+
+		etcd3, ok := parsed["etcd3"].(map[string]any)
+		assert.Assert(t, ok, "expected etcd3 section")
+		assert.Equal(t, etcd3["cacert"], "/etc/patroni/etcd-tls/ca.crt")
+		assert.Equal(t, etcd3["cert"], "/etc/patroni/etcd-tls/tls.crt")
+		assert.Equal(t, etcd3["key"], "/etc/patroni/etcd-tls/tls.key")
+	})
+
+	t.Run("etcd DCS - multiple endpoints", func(t *testing.T) {
+		cluster := new(v1beta1.PostgresCluster)
+		assert.NilError(t, cluster.Default(context.Background(), nil))
+		cluster.Namespace = "some-namespace"
+		cluster.Name = "cluster-name"
+		cluster.Spec.Patroni = &v1beta1.PatroniSpec{
+			DCS: &v1beta1.PatroniDCS{
+				Type: v1beta1.PatroniDCSTypeEtcd,
+				Etcd: &v1beta1.PatroniEtcdSpec{
+					Endpoints: []string{
+						"https://etcd0:2379",
+						"https://etcd1:2379",
+						"https://etcd2:2379",
+					},
+				},
+			},
+		}
+		cluster.Spec.Patroni.Default()
+
+		data, err := clusterYAML(cluster, postgres.HBAs{}, postgres.Parameters{})
+		assert.NilError(t, err)
+
+		var parsed map[string]any
+		assert.NilError(t, yaml.Unmarshal([]byte(data), &parsed))
+
+		etcd3, ok := parsed["etcd3"].(map[string]any)
+		assert.Assert(t, ok, "expected etcd3 section")
+
+		hosts, ok := etcd3["hosts"].([]any)
+		assert.Assert(t, ok, "expected etcd3.hosts to be a list")
+		assert.Equal(t, len(hosts), 3)
+		assert.Equal(t, hosts[0], "etcd0:2379")
+		assert.Equal(t, hosts[1], "etcd1:2379")
+		assert.Equal(t, hosts[2], "etcd2:2379")
+	})
+}
+
+func TestEtcdHosts(t *testing.T) {
+	t.Parallel()
+
+	for _, tt := range []struct {
+		name      string
+		endpoints []string
+		want      []string
+	}{
+		{
+			name:      "strips https scheme",
+			endpoints: []string{"https://etcd.cluster.svc:2379"},
+			want:      []string{"etcd.cluster.svc:2379"},
+		},
+		{
+			name:      "strips http scheme",
+			endpoints: []string{"http://etcd:2379"},
+			want:      []string{"etcd:2379"},
+		},
+		{
+			name:      "multiple endpoints",
+			endpoints: []string{"https://etcd0:2379", "https://etcd1:2379"},
+			want:      []string{"etcd0:2379", "etcd1:2379"},
+		},
+		{
+			name:      "bare host passthrough",
+			endpoints: []string{"etcd:2379"},
+			want:      []string{"etcd:2379"},
+		},
+		{
+			name:      "empty list",
+			endpoints: []string{},
+			want:      []string{},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			got := etcdHosts(tt.endpoints)
+			assert.Equal(t, len(got), len(tt.want))
+			for i := range tt.want {
+				assert.Equal(t, got[i], tt.want[i])
+			}
+		})
+	}
+}
+
+func TestEtcdProtocol(t *testing.T) {
+	t.Parallel()
+
+	for _, tt := range []struct {
+		name      string
+		endpoints []string
+		want      string
+	}{
+		{
+			name:      "https from first endpoint",
+			endpoints: []string{"https://etcd:2379"},
+			want:      "https",
+		},
+		{
+			name:      "http from first endpoint",
+			endpoints: []string{"http://etcd:2379"},
+			want:      "http",
+		},
+		{
+			name:      "first endpoint determines protocol",
+			endpoints: []string{"https://etcd0:2379", "http://etcd1:2379"},
+			want:      "https",
+		},
+		{
+			name:      "bare host defaults to http",
+			endpoints: []string{"etcd:2379"},
+			want:      "http",
+		},
+		{
+			name:      "empty list defaults to http",
+			endpoints: []string{},
+			want:      "http",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			got := etcdProtocol(tt.endpoints)
+			assert.Equal(t, got, tt.want)
+		})
+	}
 }
 
 func TestDynamicConfiguration(t *testing.T) {
@@ -1123,6 +1345,38 @@ func TestInstanceEnvironment(t *testing.T) {
   value: /etc/patroni
 		`))
 	})
+
+	t.Run("etcd DCS - no PATRONI_KUBERNETES_* vars", func(t *testing.T) {
+		clusterEtcd := new(v1beta1.PostgresCluster)
+		assert.NilError(t, clusterEtcd.Default(context.Background(), nil))
+		clusterEtcd.Spec.PostgresVersion = 12
+		clusterEtcd.Spec.Patroni = &v1beta1.PatroniSpec{
+			DCS: &v1beta1.PatroniDCS{
+				Type: v1beta1.PatroniDCSTypeEtcd,
+				Etcd: &v1beta1.PatroniEtcdSpec{
+					Endpoints: []string{"https://etcd:2379"},
+				},
+			},
+		}
+		clusterEtcd.Spec.Patroni.Default()
+
+		etcdVars := instanceEnvironment(clusterEtcd, podService, leaderService, nil)
+
+		for _, ev := range etcdVars {
+			assert.Assert(t, ev.Name != "PATRONI_KUBERNETES_POD_IP",
+				"expected no PATRONI_KUBERNETES_POD_IP for etcd DCS")
+			assert.Assert(t, ev.Name != "PATRONI_KUBERNETES_PORTS",
+				"expected no PATRONI_KUBERNETES_PORTS for etcd DCS")
+		}
+
+		var names []string
+		for _, ev := range etcdVars {
+			names = append(names, ev.Name)
+		}
+		assert.Assert(t, slices.Contains(names, "PATRONI_NAME"), "expected PATRONI_NAME")
+		assert.Assert(t, slices.Contains(names, "PATRONI_POSTGRESQL_CONNECT_ADDRESS"), "expected PATRONI_POSTGRESQL_CONNECT_ADDRESS")
+		assert.Assert(t, slices.Contains(names, "PATRONICTL_CONFIG_FILE"), "expected PATRONICTL_CONFIG_FILE")
+	})
 }
 
 func TestInstanceYAML(t *testing.T) {
@@ -1250,6 +1504,37 @@ postgresql:
 restapi: {}
 tags: {}
 	`, "\t\n")+"\n")
+
+	t.Run("etcd DCS - no kubernetes section", func(t *testing.T) {
+		clusterEtcd := &v1beta1.PostgresCluster{
+			ObjectMeta: metav1.ObjectMeta{
+				Annotations: map[string]string{
+					pNaming.ToCrunchyAnnotation(pNaming.AnnotationPatroniVersion): "4.0.1",
+				},
+			},
+			Spec: v1beta1.PostgresClusterSpec{
+				PostgresVersion: 12,
+				Patroni: &v1beta1.PatroniSpec{
+					DCS: &v1beta1.PatroniDCS{
+						Type: v1beta1.PatroniDCSTypeEtcd,
+						Etcd: &v1beta1.PatroniEtcdSpec{
+							Endpoints: []string{"https://etcd:2379"},
+						},
+					},
+				},
+			},
+		}
+		etcdInstance := new(v1beta1.PostgresInstanceSetSpec)
+
+		etcdData, err := instanceYAML(clusterEtcd, etcdInstance, nil)
+		assert.NilError(t, err)
+
+		var parsed map[string]any
+		assert.NilError(t, yaml.Unmarshal([]byte(etcdData), &parsed))
+
+		_, hasKubernetes := parsed["kubernetes"]
+		assert.Assert(t, !hasKubernetes, "expected no kubernetes section for etcd DCS")
+	})
 }
 
 func TestPGBackRestCreateReplicaCommand(t *testing.T) {
diff --git a/internal/patroni/rbac.go b/internal/patroni/rbac.go
index 2e19339ed9..521298fb6f 100644
--- a/internal/patroni/rbac.go
+++ b/internal/patroni/rbac.go
@@ -34,22 +34,27 @@ import (
 
 // Permissions returns the RBAC rules Patroni needs for cluster.
 func Permissions(cluster *v1beta1.PostgresCluster) []rbacv1.PolicyRule {
-	// TODO(cbandy): This must change when using ConfigMaps for DCS.
-
 	rules := make([]rbacv1.PolicyRule, 0, 4)
 
-	rules = append(rules, rbacv1.PolicyRule{
-		APIGroups: []string{corev1.SchemeGroupVersion.Group},
-		Resources: []string{"endpoints"},
-		Verbs:     []string{"create", "deletecollection", "get", "list", "patch", "watch"},
-	})
+	usingKubernetesDCS := !cluster.UsesExternalDCS()
 
-	if cluster.Spec.OpenShift != nil && *cluster.Spec.OpenShift {
+	if usingKubernetesDCS {
+		// When using Endpoints for DCS, "create", "list", "patch", and "watch"
+		// are required. The `patronictl scaffold` and `patronictl remove`
+		// commands require "deletecollection".
 		rules = append(rules, rbacv1.PolicyRule{
 			APIGroups: []string{corev1.SchemeGroupVersion.Group},
-			Resources: []string{"endpoints/restricted"},
-			Verbs:     []string{"create"},
+			Resources: []string{"endpoints"},
+			Verbs:     []string{"create", "deletecollection", "get", "list", "patch", "watch"},
 		})
+
+		if cluster.Spec.OpenShift != nil && *cluster.Spec.OpenShift {
+			rules = append(rules, rbacv1.PolicyRule{
+				APIGroups: []string{corev1.SchemeGroupVersion.Group},
+				Resources: []string{"endpoints/restricted"},
+				Verbs:     []string{"create"},
+			})
+		}
 	}
 
 	rules = append(rules, rbacv1.PolicyRule{
@@ -58,15 +63,17 @@ func Permissions(cluster *v1beta1.PostgresCluster) []rbacv1.PolicyRule {
 		Verbs:     []string{"get", "list", "patch", "watch"},
 	})
 
-	// When using Endpoints for DCS, Patroni tries to create the "{scope}-config" service.
-	// NOTE(cbandy): The PostgresCluster controller already creates this Service;
-	// it might be possible to eliminate this permission if it also created the
-	// Endpoints.
-	rules = append(rules, rbacv1.PolicyRule{
-		APIGroups: []string{corev1.SchemeGroupVersion.Group},
-		Resources: []string{"services"},
-		Verbs:     []string{"create"},
-	})
+	if usingKubernetesDCS {
+		// Patroni tries to create the "{scope}-config" service.
+		// NOTE(cbandy): The PostgresCluster controller already creates this
+		// Service; it might be possible to eliminate this permission if it
+		// also created the Endpoints.
+		rules = append(rules, rbacv1.PolicyRule{
+			APIGroups: []string{corev1.SchemeGroupVersion.Group},
+			Resources: []string{"services"},
+			Verbs:     []string{"create"},
+		})
+	}
 
 	return rules
 }
diff --git a/internal/patroni/reconcile.go b/internal/patroni/reconcile.go
index ece6cea757..f32b4259f2 100644
--- a/internal/patroni/reconcile.go
+++ b/internal/patroni/reconcile.go
@@ -6,11 +6,14 @@ package patroni
 
 import (
 	"context"
+	"fmt"
+	"path"
 	"strings"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
 
 	"github.com/percona/percona-postgresql-operator/v2/internal/initialize"
 	"github.com/percona/percona-postgresql-operator/v2/internal/naming"
@@ -135,6 +138,15 @@ func InstancePod(ctx context.Context,
 		ReadOnly:  true,
 	})
 
+	// Mount etcd TLS Secret and inject auth env vars when the etcd DCS backend is configured.
+	//TODO: support other dcs
+	if inCluster.DCSType() == v1beta1.PatroniDCSTypeEtcd {
+		volumes, mounts, env := etcdDCSMounts(inCluster)
+		outInstancePod.Spec.Volumes = append(outInstancePod.Spec.Volumes, volumes...)
+		container.VolumeMounts = append(container.VolumeMounts, mounts...)
+		container.Env = append(container.Env, env...)
+	}
+
 	instanceProbes(inCluster, container)
 
 	// K8SPG-708
@@ -145,6 +157,111 @@ func InstancePod(ctx context.Context,
 	return nil
 }
 
+// etcdDCSMounts returns the etcd TLS volume/mount and PATRONI_ETCD3_* auth env
+// vars needed by any Patroni process (a running instance or a one-off
+// "patronictl" invocation) to reach cluster's etcd DCS. Returns nils when TLS
+// or auth secrets aren't configured.
+func etcdDCSMounts(cluster *v1beta1.PostgresCluster) (
+	volumes []corev1.Volume, mounts []corev1.VolumeMount, env []corev1.EnvVar,
+) {
+	dcs := cluster.GetDCS()
+	if dcs == nil || dcs.Etcd == nil {
+		return nil, nil, nil
+	}
+	etcd := dcs.Etcd
+
+	if etcd.TLSSecret != "" {
+		volumes = append(volumes, corev1.Volume{
+			Name: "patroni-etcd-tls",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					SecretName:  etcd.TLSSecret,
+					DefaultMode: ptr.To(int32(0o400)),
+				},
+			},
+		})
+		mounts = append(mounts, corev1.VolumeMount{
+			Name:      "patroni-etcd-tls",
+			MountPath: path.Join(configDirectory, "etcd-tls"),
+			ReadOnly:  true,
+		})
+	}
+
+	if etcd.AuthSecret != "" {
+		// Patroni reads PATRONI_ETCD3_USERNAME and PATRONI_ETCD3_PASSWORD
+		// as overrides for etcd3.username and etcd3.password in the config.
+		env = append(env,
+			corev1.EnvVar{
+				Name: "PATRONI_ETCD3_USERNAME",
+				ValueFrom: &corev1.EnvVarSource{
+					SecretKeyRef: &corev1.SecretKeySelector{
+						LocalObjectReference: corev1.LocalObjectReference{Name: etcd.AuthSecret},
+						Key:                  "username",
+					},
+				},
+			},
+			corev1.EnvVar{
+				Name: "PATRONI_ETCD3_PASSWORD",
+				ValueFrom: &corev1.EnvVarSource{
+					SecretKeyRef: &corev1.SecretKeySelector{
+						LocalObjectReference: corev1.LocalObjectReference{Name: etcd.AuthSecret},
+						Key:                  "password",
+					},
+				},
+			},
+		)
+	}
+
+	return volumes, mounts, env
+}
+
+// DCSCleanupJob populates a PodTemplateSpec's existing "database"-named
+// container to run "patronictl remove" against cluster's Patroni DCS
+// backend. Used only when cluster.UsesExternalDCS() (e.g. etcd), to clear
+// Patroni's DCS state (leader lock, members, and the "initialize" key) before
+// an in-place restore re-bootstraps the cluster against a restored data
+// directory.
+func DCSCleanupJob(
+	cluster *v1beta1.PostgresCluster,
+	clusterConfigMap, instanceConfigMap *corev1.ConfigMap,
+	inInstanceCertificates *corev1.Secret,
+	outPod *corev1.PodTemplateSpec,
+) {
+	var container *corev1.Container
+	for i := range outPod.Spec.Containers {
+		if outPod.Spec.Containers[i].Name == naming.ContainerDatabase {
+			container = &outPod.Spec.Containers[i]
+		}
+	}
+
+	scope := naming.PatroniScope(cluster)
+	configFile := path.Join(configDirectory, "~postgres-operator_cluster.yaml")
+	container.Command = []string{"sh", "-c",
+		fmt.Sprintf("printf '%s\\nYes I am aware\\n' %s | exec patronictl -c %s remove %s",
+			quoteShellWord(scope), quoteShellWord(scope), quoteShellWord(configFile), quoteShellWord(scope)),
+	}
+
+	volume := corev1.Volume{Name: "patroni-config"}
+	volume.Projected = new(corev1.ProjectedVolumeSource)
+	volume.Projected.Sources = append(append(volume.Projected.Sources,
+		instanceConfigFiles(clusterConfigMap, instanceConfigMap)...),
+		instanceCertificates(inInstanceCertificates)...)
+
+	outPod.Spec.Volumes = append(outPod.Spec.Volumes, volume)
+	container.VolumeMounts = append(container.VolumeMounts, corev1.VolumeMount{
+		Name:      volume.Name,
+		MountPath: configDirectory,
+		ReadOnly:  true,
+	})
+
+	if cluster.DCSType() == v1beta1.PatroniDCSTypeEtcd {
+		volumes, mounts, env := etcdDCSMounts(cluster)
+		outPod.Spec.Volumes = append(outPod.Spec.Volumes, volumes...)
+		container.VolumeMounts = append(container.VolumeMounts, mounts...)
+		container.Env = append(container.Env, env...)
+	}
+}
+
 // K8SPG-708 instanceInitContainer adds the instance init container
 func instanceInitContainer(cluster *v1beta1.PostgresCluster, container *corev1.Container, instancePod *corev1.PodTemplateSpec, inInstanceSpec *v1beta1.PostgresInstanceSetSpec, initImage string) {
 	initContainer := k8s.InitContainer(
diff --git a/percona/controller/pgcluster/controller.go b/percona/controller/pgcluster/controller.go
index 6a723529fb..b9dcb62ca8 100644
--- a/percona/controller/pgcluster/controller.go
+++ b/percona/controller/pgcluster/controller.go
@@ -106,7 +106,10 @@ func (r *PGClusterReconciler) SetupWithManager(ctx context.Context, mgr manager.
 		For(&v2.PerconaPGCluster{}).
 		Owns(&v1beta1.PostgresCluster{}).
 		WatchesRawSource(source.Kind(mgr.GetCache(), &corev1.Service{}, r.watchServices())).
-		Watches(&corev1.Secret{}, r.watchEnvFromSecrets()).
+		Watches(&corev1.Secret{}, r.watchNamedSecrets(
+			namedSecretIndex{v2.IndexFieldEnvFromSecrets, "watchEnvFromSecrets"},
+			namedSecretIndex{v2.IndexFieldPatroniEtcdSecrets, "watchPatroniEtcdSecrets"},
+		)).
 		Watches(&corev1.Secret{}, r.watchPGBouncerUserSecrets()).
 		WatchesRawSource(source.Kind(mgr.GetCache(), &corev1.Secret{}, r.watchSecrets())).
 		WatchesRawSource(source.Kind(mgr.GetCache(), &batchv1.Job{}, r.watchBackupJobs())).
@@ -168,28 +171,41 @@ func (r *PGClusterReconciler) watchPGBackups() handler.TypedFuncs[*v2.PerconaPGB
 	}
 }
 
-func (r *PGClusterReconciler) watchEnvFromSecrets() handler.TypedEventHandler[client.Object, reconcile.Request] {
-	return handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
-		log := logf.FromContext(ctx).WithName("watchEnvFromSecrets")
+// namedSecretIndex pairs a field index name with a log label for watchNamedSecrets.
+type namedSecretIndex struct {
+	field   string
+	logName string
+}
 
+// watchNamedSecrets returns a single handler that, for each Secret event,
+// queries all provided field indexes and enqueues deduplicated reconcile
+// requests. Using one Watches registration avoids redundant per-event
+// iterations when multiple indexes cover the same Secret GVK.
+func (r *PGClusterReconciler) watchNamedSecrets(indexes ...namedSecretIndex) handler.TypedEventHandler[client.Object, reconcile.Request] {
+	return handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
 		secret, ok := obj.(*corev1.Secret)
 		if !ok {
 			return nil
 		}
 
-		var clusters v2.PerconaPGClusterList
-		if err := r.Client.List(ctx, &clusters, client.MatchingFields{
-			v2.IndexFieldEnvFromSecrets: secret.Name,
-		}, client.InNamespace(secret.Namespace)); err != nil {
-			log.Error(err, "Failed to list clusters by env from secrets index failed", "key", client.ObjectKeyFromObject(secret).String())
-			return nil
-		}
-
-		reqs := make([]reconcile.Request, 0, len(clusters.Items))
-		for _, cr := range clusters.Items {
-			reqs = append(reqs, reconcile.Request{
-				NamespacedName: client.ObjectKeyFromObject(&cr),
-			})
+		seen := make(map[types.NamespacedName]struct{})
+		var reqs []reconcile.Request
+		for _, idx := range indexes {
+			log := logf.FromContext(ctx).WithName(idx.logName)
+			var clusters v2.PerconaPGClusterList
+			if err := r.Client.List(ctx, &clusters,
+				client.MatchingFields{idx.field: secret.Name},
+				client.InNamespace(secret.Namespace)); err != nil {
+				log.Error(err, "list clusters by secret index", "key", client.ObjectKeyFromObject(secret).String())
+				continue
+			}
+			for _, cl := range clusters.Items {
+				key := client.ObjectKeyFromObject(&cl)
+				if _, dup := seen[key]; !dup {
+					seen[key] = struct{}{}
+					reqs = append(reqs, reconcile.Request{NamespacedName: key})
+				}
+			}
 		}
 		return reqs
 	})
@@ -314,6 +330,10 @@ func (r *PGClusterReconciler) Reconcile(ctx context.Context, request reconcile.R
 		return reconcile.Result{}, errors.Wrap(err, "ensure finalizers")
 	}
 
+	if err := r.reconcilePatroniEtcd(ctx, cr); err != nil {
+		return reconcile.Result{}, errors.Wrap(err, "reconcile patroni etcd")
+	}
+
 	if err := r.reconcilePatroniVersionCheckPod(ctx, cr); err != nil {
 		if errors.Is(err, errPatroniVersionCheckWait) {
 			return reconcile.Result{
diff --git a/percona/controller/pgcluster/patroni_etcd.go b/percona/controller/pgcluster/patroni_etcd.go
new file mode 100644
index 0000000000..c5eb802d4d
--- /dev/null
+++ b/percona/controller/pgcluster/patroni_etcd.go
@@ -0,0 +1,79 @@
+// Copyright 2021 - 2024 Crunchy Data Solutions, Inc.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package pgcluster
+
+import (
+	"context"
+
+	"github.com/hashicorp/go-multierror"
+	"github.com/pkg/errors"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	v2 "github.com/percona/percona-postgresql-operator/v2/pkg/apis/pgv2.percona.com/v2"
+	v1beta1 "github.com/percona/percona-postgresql-operator/v2/pkg/apis/upstream.pgv2.percona.com/v1beta1"
+)
+
+// reconcilePatroniEtcd validates that secrets referenced in the etcd DCS
+// configuration exist and contain the required keys. Emits Warning events for
+// every problem found and returns a combined error so the operator surfaces all
+// issues in a single reconcile cycle.
+func (r *PGClusterReconciler) reconcilePatroniEtcd(ctx context.Context, cr *v2.PerconaPGCluster) error {
+	if cr.Spec.Patroni == nil {
+		return nil
+	}
+	if cr.Spec.Patroni.DCSType() != v1beta1.PatroniDCSTypeEtcd {
+		return nil
+	}
+	dcs := cr.Spec.Patroni.GetDCS()
+	if dcs.Etcd == nil {
+		return nil
+	}
+	etcd := dcs.Etcd
+
+	var errs []error
+	if etcd.TLSSecret != "" {
+		if err := r.requireSecret(ctx, cr, etcd.TLSSecret,
+			"EtcdTLSSecretNotFound", "EtcdTLSSecretInvalid",
+			[]string{"ca.crt", "tls.crt", "tls.key"}); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	if etcd.AuthSecret != "" {
+		if err := r.requireSecret(ctx, cr, etcd.AuthSecret,
+			"EtcdAuthSecretNotFound", "EtcdAuthSecretInvalid",
+			[]string{"username", "password"}); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return multierror.Append(nil, errs...).ErrorOrNil()
+}
+
+// requireSecret fetches the named Secret and validates that each key in
+// requiredKeys is present in Secret.Data. Emits a Warning event and returns
+// an error if the Secret is missing or any required key is absent.
+// notFoundReason is used when the Secret does not exist; invalidReason is used
+// when the Secret exists but is missing a required key.
+func (r *PGClusterReconciler) requireSecret(ctx context.Context, cr *v2.PerconaPGCluster, name, notFoundReason, invalidReason string, requiredKeys []string) error {
+	secret := &corev1.Secret{}
+	err := r.Client.Get(ctx, types.NamespacedName{Name: name, Namespace: cr.Namespace}, secret)
+	if client.IgnoreNotFound(err) != nil {
+		return errors.Wrapf(err, "get secret %q", name)
+	}
+	if err != nil {
+		r.Recorder.Eventf(cr, corev1.EventTypeWarning, notFoundReason,
+			"Secret %q not found in namespace %q", name, cr.Namespace)
+		return errors.Errorf("secret %q not found", name)
+	}
+	for _, key := range requiredKeys {
+		if _, ok := secret.Data[key]; !ok {
+			r.Recorder.Eventf(cr, corev1.EventTypeWarning, invalidReason,
+				"Secret %q is missing required key %q", name, key)
+			return errors.Errorf("secret %q missing required key %q", name, key)
+		}
+	}
+	return nil
+}
diff --git a/percona/controller/pgcluster/patroni_etcd_test.go b/percona/controller/pgcluster/patroni_etcd_test.go
new file mode 100644
index 0000000000..887f3f3dbc
--- /dev/null
+++ b/percona/controller/pgcluster/patroni_etcd_test.go
@@ -0,0 +1,229 @@
+// Copyright 2021 - 2024 Crunchy Data Solutions, Inc.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package pgcluster
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"gotest.tools/v3/assert"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/tools/record"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	v2 "github.com/percona/percona-postgresql-operator/v2/pkg/apis/pgv2.percona.com/v2"
+	v1beta1 "github.com/percona/percona-postgresql-operator/v2/pkg/apis/upstream.pgv2.percona.com/v1beta1"
+)
+
+func newEtcdTestReconciler(t *testing.T, objs ...corev1.Secret) *PGClusterReconciler {
+	t.Helper()
+
+	s := scheme.Scheme
+	if err := v1beta1.AddToScheme(s); err != nil {
+		t.Fatalf("AddToScheme: %v", err)
+	}
+	if err := v2.AddToScheme(s); err != nil {
+		t.Fatalf("AddToScheme: %v", err)
+	}
+
+	builder := fake.NewClientBuilder().WithScheme(s)
+	for i := range objs {
+		builder = builder.WithObjects(&objs[i])
+	}
+
+	return &PGClusterReconciler{
+		Client:   builder.Build(),
+		Recorder: record.NewFakeRecorder(10),
+	}
+}
+
+func drainEvents(r *PGClusterReconciler) []string {
+	ch := r.Recorder.(*record.FakeRecorder).Events
+	var events []string
+	for {
+		select {
+		case e := <-ch:
+			events = append(events, e)
+		default:
+			return events
+		}
+	}
+}
+
+func etcdCR(dcs *v1beta1.PatroniDCS) *v2.PerconaPGCluster {
+	return &v2.PerconaPGCluster{
+		ObjectMeta: metav1.ObjectMeta{Name: "test-cluster", Namespace: "ns"},
+		Spec: v2.PerconaPGClusterSpec{
+			Patroni: &v1beta1.PatroniSpec{DCS: dcs},
+		},
+	}
+}
+
+func TestReconcilePatroniEtcd(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("nil patroni spec returns nil", func(t *testing.T) {
+		r := newEtcdTestReconciler(t)
+		cr := &v2.PerconaPGCluster{
+			ObjectMeta: metav1.ObjectMeta{Name: "cluster", Namespace: "ns"},
+		}
+		assert.NilError(t, r.reconcilePatroniEtcd(ctx, cr))
+		assert.Equal(t, len(drainEvents(r)), 0)
+	})
+
+	t.Run("kubernetes DCS returns nil", func(t *testing.T) {
+		r := newEtcdTestReconciler(t)
+		cr := etcdCR(&v1beta1.PatroniDCS{Type: v1beta1.PatroniDCSTypeKubernetes})
+		assert.NilError(t, r.reconcilePatroniEtcd(ctx, cr))
+		assert.Equal(t, len(drainEvents(r)), 0)
+	})
+
+	t.Run("nil dcs returns nil", func(t *testing.T) {
+		r := newEtcdTestReconciler(t)
+		cr := etcdCR(nil)
+		assert.NilError(t, r.reconcilePatroniEtcd(ctx, cr))
+		assert.Equal(t, len(drainEvents(r)), 0)
+	})
+
+	t.Run("etcd DCS no secrets returns nil", func(t *testing.T) {
+		r := newEtcdTestReconciler(t)
+		cr := etcdCR(&v1beta1.PatroniDCS{
+			Type: v1beta1.PatroniDCSTypeEtcd,
+			Etcd: &v1beta1.PatroniEtcdSpec{
+				Endpoints: []string{"https://etcd:2379"},
+			},
+		})
+		assert.NilError(t, r.reconcilePatroniEtcd(ctx, cr))
+		assert.Equal(t, len(drainEvents(r)), 0)
+	})
+
+	t.Run("tls secret missing emits warning and error", func(t *testing.T) {
+		r := newEtcdTestReconciler(t)
+		cr := etcdCR(&v1beta1.PatroniDCS{
+			Type: v1beta1.PatroniDCSTypeEtcd,
+			Etcd: &v1beta1.PatroniEtcdSpec{
+				Endpoints: []string{"https://etcd:2379"},
+				TLSSecret: "missing-tls",
+			},
+		})
+		err := r.reconcilePatroniEtcd(ctx, cr)
+		assert.ErrorContains(t, err, "missing-tls")
+		events := drainEvents(r)
+		assert.Equal(t, len(events), 1)
+		assert.Assert(t, strings.Contains(events[0], "EtcdTLSSecretNotFound"))
+	})
+
+	t.Run("tls secret missing ca.crt key emits warning and error", func(t *testing.T) {
+		secret := corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{Name: "tls-secret", Namespace: "ns"},
+			Data: map[string][]byte{
+				"tls.crt": []byte("cert"),
+				"tls.key": []byte("key"),
+				// ca.crt is intentionally absent
+			},
+		}
+		r := newEtcdTestReconciler(t, secret)
+		cr := etcdCR(&v1beta1.PatroniDCS{
+			Type: v1beta1.PatroniDCSTypeEtcd,
+			Etcd: &v1beta1.PatroniEtcdSpec{
+				Endpoints: []string{"https://etcd:2379"},
+				TLSSecret: "tls-secret",
+			},
+		})
+		err := r.reconcilePatroniEtcd(ctx, cr)
+		assert.ErrorContains(t, err, "ca.crt")
+		events := drainEvents(r)
+		assert.Equal(t, len(events), 1)
+		assert.Assert(t, strings.Contains(events[0], "EtcdTLSSecretInvalid"))
+	})
+
+	t.Run("auth secret missing emits warning and error", func(t *testing.T) {
+		r := newEtcdTestReconciler(t)
+		cr := etcdCR(&v1beta1.PatroniDCS{
+			Type: v1beta1.PatroniDCSTypeEtcd,
+			Etcd: &v1beta1.PatroniEtcdSpec{
+				Endpoints:  []string{"https://etcd:2379"},
+				AuthSecret: "missing-auth-secret",
+			},
+		})
+		err := r.reconcilePatroniEtcd(ctx, cr)
+		assert.ErrorContains(t, err, "missing-auth-secret")
+		events := drainEvents(r)
+		assert.Equal(t, len(events), 1)
+		assert.Assert(t, strings.Contains(events[0], "EtcdAuthSecretNotFound"))
+	})
+
+	t.Run("auth secret missing password key emits warning and error", func(t *testing.T) {
+		secret := corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{Name: "auth-secret", Namespace: "ns"},
+			Data: map[string][]byte{
+				"username": []byte("etcduser"),
+				// password is intentionally absent
+			},
+		}
+		r := newEtcdTestReconciler(t, secret)
+		cr := etcdCR(&v1beta1.PatroniDCS{
+			Type: v1beta1.PatroniDCSTypeEtcd,
+			Etcd: &v1beta1.PatroniEtcdSpec{
+				Endpoints:  []string{"https://etcd:2379"},
+				AuthSecret: "auth-secret",
+			},
+		})
+		err := r.reconcilePatroniEtcd(ctx, cr)
+		assert.ErrorContains(t, err, "password")
+		events := drainEvents(r)
+		assert.Equal(t, len(events), 1)
+		assert.Assert(t, strings.Contains(events[0], "EtcdAuthSecretInvalid"))
+	})
+
+	t.Run("both secrets valid returns nil", func(t *testing.T) {
+		tlsSecret := corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{Name: "tls-secret", Namespace: "ns"},
+			Data: map[string][]byte{
+				"ca.crt":  []byte("ca"),
+				"tls.crt": []byte("cert"),
+				"tls.key": []byte("key"),
+			},
+		}
+		authSecret := corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{Name: "auth-secret", Namespace: "ns"},
+			Data: map[string][]byte{
+				"username": []byte("etcduser"),
+				"password": []byte("etcdpass"),
+			},
+		}
+		r := newEtcdTestReconciler(t, tlsSecret, authSecret)
+		cr := etcdCR(&v1beta1.PatroniDCS{
+			Type: v1beta1.PatroniDCSTypeEtcd,
+			Etcd: &v1beta1.PatroniEtcdSpec{
+				Endpoints:  []string{"https://etcd:2379"},
+				TLSSecret:  "tls-secret",
+				AuthSecret: "auth-secret",
+			},
+		})
+		assert.NilError(t, r.reconcilePatroniEtcd(ctx, cr))
+		assert.Equal(t, len(drainEvents(r)), 0)
+	})
+
+	t.Run("both secrets missing reports both in one cycle", func(t *testing.T) {
+		r := newEtcdTestReconciler(t)
+		cr := etcdCR(&v1beta1.PatroniDCS{
+			Type: v1beta1.PatroniDCSTypeEtcd,
+			Etcd: &v1beta1.PatroniEtcdSpec{
+				Endpoints:  []string{"https://etcd:2379"},
+				TLSSecret:  "missing-tls",
+				AuthSecret: "missing-auth",
+			},
+		})
+		err := r.reconcilePatroniEtcd(ctx, cr)
+		assert.ErrorContains(t, err, "missing-tls")
+		assert.ErrorContains(t, err, "missing-auth")
+		events := drainEvents(r)
+		assert.Equal(t, len(events), 2)
+	})
+}
diff --git a/pkg/apis/pgv2.percona.com/v2/perconapgcluster_types.go b/pkg/apis/pgv2.percona.com/v2/perconapgcluster_types.go
index 41f32bb54c..6d1d4de482 100644
--- a/pkg/apis/pgv2.percona.com/v2/perconapgcluster_types.go
+++ b/pkg/apis/pgv2.percona.com/v2/perconapgcluster_types.go
@@ -1404,6 +1404,34 @@ var EnvFromSecretsIndexerFunc client.IndexerFunc = func(obj client.Object) []str
 	return cr.EnvFromSecrets()
 }
 
+// IndexFieldPatroniEtcdSecrets is the field index name for secrets referenced
+// by spec.patroni.dcs.etcd (tlsSecret and authSecret).
+const IndexFieldPatroniEtcdSecrets = "pgCluster.patroniEtcdSecrets" //nolint:gosec
+
+// PatroniEtcdSecretsIndexerFunc returns the names of secrets referenced by
+// the etcd DCS configuration so that Secret changes can trigger reconciliation.
+var PatroniEtcdSecretsIndexerFunc client.IndexerFunc = func(obj client.Object) []string {
+	cr, ok := obj.(*PerconaPGCluster)
+	if !ok || cr.Spec.Patroni == nil {
+		return nil
+	}
+	if cr.Spec.Patroni.DCSType() != crunchyv1beta1.PatroniDCSTypeEtcd {
+		return nil
+	}
+	dcs := cr.Spec.Patroni.GetDCS()
+	if dcs.Etcd == nil {
+		return nil
+	}
+	var names []string
+	if dcs.Etcd.TLSSecret != "" {
+		names = append(names, dcs.Etcd.TLSSecret)
+	}
+	if dcs.Etcd.AuthSecret != "" {
+		names = append(names, dcs.Etcd.AuthSecret)
+	}
+	return names
+}
+
 func (cr *PerconaPGCluster) PGBouncerUserSecrets() []string {
 	if cr.Spec.Proxy == nil || cr.Spec.Proxy.PGBouncer == nil ||
 		cr.Spec.Proxy.PGBouncer.UsersSecret == nil || cr.Spec.Proxy.PGBouncer.UsersSecret.Name == "" {
diff --git a/pkg/apis/upstream.pgv2.percona.com/v1beta1/patroni_types.go b/pkg/apis/upstream.pgv2.percona.com/v1beta1/patroni_types.go
index 873d6aa7b8..a7ae773099 100644
--- a/pkg/apis/upstream.pgv2.percona.com/v1beta1/patroni_types.go
+++ b/pkg/apis/upstream.pgv2.percona.com/v1beta1/patroni_types.go
@@ -46,16 +46,103 @@ type PatroniSpec struct {
 	// +optional
 	CreateReplicaMethods []CreateReplicaMethod `json:"createReplicaMethods,omitempty"`
 
-	// TODO(cbandy): Add UseConfigMaps bool, default false.
-	// TODO(cbandy): Allow other DCS: etcd, raft, etc?
-	// N.B. changing this will cause downtime.
-	// - https://patroni.readthedocs.io/en/latest/kubernetes.html
+	// DCS configures the distributed configuration store backend.
+	// Defaults to the Kubernetes-native backend (Endpoints).
+	// N.B. Changing the DCS type causes downtime; all instances must restart simultaneously.
+	// +optional
+	DCS *PatroniDCS `json:"dcs,omitempty"`
 
 	// RemoveDataDirectoryOnDivergedTimelines allows controlling remove_data_directory_on_diverged_timelines in Patroni cluster config.
 	// +optional
 	RemoveDataDirectoryOnDivergedTimelines bool `json:"removeDataDirectoryOnDivergedTimelines,omitempty"`
 }
 
+// GetDCS returns the DCS configuration, or nil if unset.
+func (s *PatroniSpec) GetDCS() *PatroniDCS {
+	if s == nil {
+		return nil
+	}
+	return s.DCS
+}
+
+// GetDCS returns the DCS configuration for the cluster, or nil if unset.
+func (c *PostgresCluster) GetDCS() *PatroniDCS {
+	return c.Spec.Patroni.GetDCS()
+}
+
+// DCSType returns the effective DCS type. Returns PatroniDCSTypeKubernetes when unset (the default).
+func (s *PatroniSpec) DCSType() PatroniDCSType {
+	if dcs := s.GetDCS(); dcs != nil {
+		return dcs.Type
+	}
+	return PatroniDCSTypeKubernetes
+}
+
+// DCSType returns the effective DCS type. Returns PatroniDCSTypeKubernetes when unset (the default).
+func (c *PostgresCluster) DCSType() PatroniDCSType {
+	return c.Spec.Patroni.DCSType()
+}
+
+// UsesExternalDCS returns true when Patroni's DCS backend is anything other
+// than the built-in Kubernetes Endpoints/ConfigMap store (e.g. etcd). Prefer
+// this over comparing DCSType() to a specific non-Kubernetes value when the
+// logic in question only cares whether Patroni manages its own state outside
+// Kubernetes -- not which external backend it uses.
+func (c *PostgresCluster) UsesExternalDCS() bool {
+	return c.DCSType() != PatroniDCSTypeKubernetes
+}
+
+// PatroniDCSType identifies which DCS backend Patroni should use.
+// +kubebuilder:validation:Enum={kubernetes,etcd}
+type PatroniDCSType string
+
+const (
+	PatroniDCSTypeKubernetes PatroniDCSType = "kubernetes"
+	PatroniDCSTypeEtcd       PatroniDCSType = "etcd"
+)
+
+// PatroniDCS configures the Patroni distributed configuration store (DCS).
+// +kubebuilder:validation:XValidation:rule="self.type != 'etcd' || (has(self.etcd) && size(self.etcd.endpoints) > 0)",message="etcd.endpoints must be non-empty when type is etcd"
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.type) || oldSelf.type == self.type",message="DCS type is immutable after cluster creation"
+type PatroniDCS struct {
+	// Type of DCS backend. Defaults to "kubernetes".
+	// Changing this is not allowed because it will lead to a downtime
+	// This field is immutable after cluster creation.
+	// +optional
+	// +kubebuilder:default=kubernetes
+	// +kubebuilder:validation:Enum={kubernetes,etcd}
+
+	Type PatroniDCSType `json:"type,omitempty"`
+
+	// Etcd holds settings for the external etcd DCS backend.
+	// Required when type is "etcd".
+	// +optional
+	Etcd *PatroniEtcdSpec `json:"etcd,omitempty"`
+}
+
+// PatroniEtcdSpec defines connectivity to an external etcd cluster used as DCS.
+type PatroniEtcdSpec struct {
+	// Endpoints is the list of etcd endpoints including scheme and port.
+	// Example: ["https://etcd.etcd-cluster.svc:2379"]
+	// The scheme of the first endpoint determines the protocol used.
+	// All endpoints must use the same scheme.
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=7
+	// +kubebuilder:validation:items:Pattern=`^https?://[^/]`
+	// +kubebuilder:validation:XValidation:rule="self.all(e, url(e).getScheme() == 'http') || self.all(e, url(e).getScheme() == 'https')",message="all endpoints must use the same scheme (http or https)"
+	Endpoints []string `json:"endpoints"`
+
+	// TLSSecret is the name of a Secret in the same namespace with keys
+	// ca.crt, tls.crt, and tls.key for mutual TLS with etcd.
+	// +optional
+	TLSSecret string `json:"tlsSecret,omitempty"`
+
+	// AuthSecret is the name of a Secret in the same namespace with keys
+	// username and password for etcd authentication.
+	// +optional
+	AuthSecret string `json:"authSecret,omitempty"`
+}
+
 // +kubebuilder:validation:Enum={basebackup,pgbackrest}
 type CreateReplicaMethod string
 
diff --git a/pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go b/pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go
index 8bb1045af0..2911b241e7 100644
--- a/pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go
+++ b/pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go
@@ -1644,6 +1644,46 @@ func (in *PGUpgradeStatus) DeepCopy() *PGUpgradeStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PatroniDCS) DeepCopyInto(out *PatroniDCS) {
+	*out = *in
+	if in.Etcd != nil {
+		in, out := &in.Etcd, &out.Etcd
+		*out = new(PatroniEtcdSpec)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PatroniDCS.
+func (in *PatroniDCS) DeepCopy() *PatroniDCS {
+	if in == nil {
+		return nil
+	}
+	out := new(PatroniDCS)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PatroniEtcdSpec) DeepCopyInto(out *PatroniEtcdSpec) {
+	*out = *in
+	if in.Endpoints != nil {
+		in, out := &in.Endpoints, &out.Endpoints
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PatroniEtcdSpec.
+func (in *PatroniEtcdSpec) DeepCopy() *PatroniEtcdSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PatroniEtcdSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PatroniSpec) DeepCopyInto(out *PatroniSpec) {
 	*out = *in
@@ -1673,6 +1713,11 @@ func (in *PatroniSpec) DeepCopyInto(out *PatroniSpec) {
 		*out = make([]CreateReplicaMethod, len(*in))
 		copy(*out, *in)
 	}
+	if in.DCS != nil {
+		in, out := &in.DCS, &out.DCS
+		*out = new(PatroniDCS)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PatroniSpec.