@@ -563,32 +563,57 @@ def filter(self, record):
 
 REDIS_SENTINEL_MASTER_NAME = os.environ.get("REDIS_SENTINEL_MASTER_NAME", "mymaster")
 
-# NOT COVERED by TestTheBackendAgreesWithCoreOnEverySharedSetting — _derive only
-# exercises the standalone branch below, so the "cache and client reach the same
-# place" property stops at this line. Four divergences from create_redis_client
-# live in here and are PRE-EXISTING on main, untouched by UN-4123:
-#   * REDIS_USER defaults to "default" above, so this cache sends a two-argument
-#     ACL AUTH where core sends the one-argument form;
-#   * it reads REDIS_USER directly, so the REDIS_USERNAME spelling is ignored;
-#   * REDIS_SSL is not applied here at all — a plaintext cache against a
-#     TLS-only Sentinel deployment;
-#   * the Sentinel default port is 26379 in core and 6379 here.
-# Left alone deliberately: this is the self-hosted HA path, a managed endpoint
-# is a single primary and does not use it, and changing behaviour here would be
-# changing code no test in this file executes. Its own ticket.
 if REDIS_SENTINEL_MODE:
+    # This branch used to hold four divergences from create_redis_client, all
+    # pre-existing. They are closed here because "the cache and the client reach
+    # the same place" is not a property that can stop at a mode boundary — an
+    # operator on Sentinel gets the same guarantee or the guarantee is a
+    # half-truth. TestSentinelModeAgreesWithCore covers each one.
+    #
+    # The username comes from the shared resolver, not the module-level
+    # REDIS_USER: that one defaults to "default", so this cache sent a
+    # two-argument ACL AUTH where core sends the one-argument form, and it read
+    # only REDIS_USER so the REDIS_USERNAME spelling platform-service ships was
+    # ignored entirely.
+    _sentinel_username = url_username_from_env()
+
+    # 26379 — the Sentinel port — matching core's
+    # _resolve_redis_env(default_port="26379"). The module-level REDIS_PORT
+    # defaults to 6379, which is the standalone port, so an unset REDIS_PORT
+    # pointed this cache at the wrong port while every other client found the
+    # sentinels. The chart always sets it, which is why this stayed hidden.
+    REDIS_PORT = parse_port(os.environ.get("REDIS_PORT"), "REDIS_PORT", 26379)
+
     _sentinel_kwargs = {}
     if REDIS_PASSWORD:
         _sentinel_kwargs["password"] = REDIS_PASSWORD
-    if REDIS_USER:
-        _sentinel_kwargs["username"] = REDIS_USER
+    if _sentinel_username:
+        _sentinel_kwargs["username"] = _sentinel_username
+
+    # TLS reached neither the discovery connections nor the master one, so a
+    # TLS-only Sentinel deployment got a plaintext cache while core encrypted
+    # both. Core builds them from one env dict for exactly this reason; the
+    # same settings go to both here.
+    _sentinel_pool_kwargs = {}
+    if REDIS_SSL:
+        _sentinel_tls = {
+            "ssl": True,
+            "ssl_cert_reqs": REDIS_SSL_CERT_REQS,
+            "ssl_check_hostname": REDIS_SSL_CHECK_HOSTNAME,
+        }
+        if REDIS_SSL_CA_CERTS:
+            _sentinel_tls["ssl_ca_certs"] = REDIS_SSL_CA_CERTS
+        _sentinel_kwargs.update(_sentinel_tls)
+        _sentinel_pool_kwargs.update(_sentinel_tls)
 
     _redis_db = parse_db(REDIS_DB, "REDIS_")
 
     # SocketIO connection manager (Kombu Sentinel URL format)
     _cred_prefix = ""
-    if REDIS_USER and REDIS_PASSWORD:
-        _cred_prefix = f"{quote(REDIS_USER, safe='')}:{quote(REDIS_PASSWORD, safe='')}@"
+    if _sentinel_username and REDIS_PASSWORD:
+        _cred_prefix = (
+            f"{quote(_sentinel_username, safe='')}:{quote(REDIS_PASSWORD, safe='')}@"
+        )
     elif REDIS_PASSWORD:
         _cred_prefix = f":{quote(REDIS_PASSWORD, safe='')}@"
     SOCKET_IO_MANAGER_URL = (
@@ -597,7 +622,7 @@ def filter(self, record):
     SOCKET_IO_TRANSPORT_OPTIONS = {"master_name": REDIS_SENTINEL_MASTER_NAME}
 
     # django-redis expects username in the LOCATION URL for ACL auth
-    _user_prefix = f"{REDIS_USER}@" if REDIS_USER else ""
+    _user_prefix = f"{_sentinel_username}@" if _sentinel_username else ""
     CACHES = {
         "default": {
             "BACKEND": "django_redis.cache.RedisCache",
@@ -608,6 +633,10 @@ def filter(self, record):
                 "CONNECTION_FACTORY": "django_redis.pool.SentinelConnectionFactory",
                 "SENTINELS": [(REDIS_HOST, REDIS_PORT)],
                 "SENTINEL_KWARGS": _sentinel_kwargs,
+                # TLS for the MASTER connection. SENTINEL_KWARGS covers only the
+                # discovery ones; core carries both, so a deployment with TLS on
+                # got an encrypted discovery and a plaintext master.
+                "CONNECTION_POOL_KWARGS": _sentinel_pool_kwargs,
                 "DB": _redis_db,
                 "PASSWORD": REDIS_PASSWORD,
                 "SERIALIZER": "django_redis.serializers.json.JSONSerializer",
 
@@ -778,3 +778,117 @@ def _from_cache(env: dict) -> dict:
     @pytest.mark.parametrize("env", _CASES, ids=lambda e: ",".join(sorted(e)))
     def test_the_cache_and_the_client_reach_the_same_place(self, env):
         assert self._from_cache(env) == self._from_core(env)
+
+
+class TestSentinelModeAgreesWithCore:
+    """The parity property must not stop at a mode boundary.
+
+    TestTheBackendAgreesWithCoreOnEverySharedSetting cannot cover Sentinel: its
+    _from_core calls create_redis_client, which in Sentinel mode performs real
+    discovery and blocks. So the comparison here is against the resolver rather
+    than a built client — _resolve_redis_env with the same default_port core's
+    Sentinel path passes — which is enough to pin the four facts that diverged.
+
+    The branch was NOT untestable, which an earlier comment in base.py claimed:
+    _derive's slice spans both branches, so it just needed an env that selects
+    this one. "No test executes it" and "no test was written for it" are
+    different statements, and only the second was true.
+    """
+
+    @staticmethod
+    def _core(**env: str) -> dict:
+        import os
+
+        from unstract.core.cache.redis_client import _resolve_redis_env
+
+        saved = {k: os.environ.get(k) for k in list(os.environ) if "REDIS" in k}
+        for key in saved:
+            os.environ.pop(key, None)
+        os.environ.update(env)
+        try:
+            return _resolve_redis_env("REDIS_", default_port="26379")
+        finally:
+            for key in list(os.environ):
+                if "REDIS" in key:
+                    os.environ.pop(key, None)
+            os.environ.update({k: v for k, v in saved.items() if v is not None})
+
+    def test_the_sentinel_port_default_matches_core(self):
+        """REDIS_PORT unset pointed this cache at 6379 — the STANDALONE port —
+        while every other client found the sentinels on 26379."""
+        env = {"REDIS_SENTINEL_MODE": "true", "REDIS_HOST": "sent"}
+        sentinels = _derive(**env)["CACHES"]["default"]["OPTIONS"]["SENTINELS"]
+        assert sentinels == [("sent", self._core(**env)["port"])]
+        assert sentinels == [("sent", 26379)]
+
+    def test_an_explicit_port_still_wins(self):
+        env = {"REDIS_SENTINEL_MODE": "true", "REDIS_HOST": "sent", "REDIS_PORT": "27000"}
+        assert _derive(**env)["CACHES"]["default"]["OPTIONS"]["SENTINELS"] == [
+            ("sent", 27000)
+        ]
+
+    def test_no_username_configured_means_no_username_sent(self):
+        """REDIS_USER defaults to "default" at module scope, so this cache sent
+        a two-argument ACL AUTH where core sends the one-argument form."""
+        env = {
+            "REDIS_SENTINEL_MODE": "true",
+            "REDIS_HOST": "sent",
+            "REDIS_PASSWORD": "pw",
+        }
+        cache = _derive(**env)["CACHES"]["default"]
+        assert self._core(**env)["username"] is None
+        assert "username" not in cache["OPTIONS"]["SENTINEL_KWARGS"]
+        assert urlsplit(cache["LOCATION"]).username is None
+
+    @pytest.mark.parametrize("spelling", ["REDIS_USER", "REDIS_USERNAME"])
+    def test_both_username_spellings_reach_the_sentinel_cache(self, spelling):
+        """platform-service ships REDIS_USERNAME; reading only REDIS_USER left
+        this cache authenticating as `default` while core used the ACL user."""
+        env = {
+            "REDIS_SENTINEL_MODE": "true",
+            "REDIS_HOST": "sent",
+            "REDIS_PASSWORD": "pw",
+            spelling: "alice",
+        }
+        derived = _derive(**env)
+        cache = derived["CACHES"]["default"]
+        assert self._core(**env)["username"] == "alice"
+        assert cache["OPTIONS"]["SENTINEL_KWARGS"]["username"] == "alice"
+        assert urlsplit(cache["LOCATION"]).username == "alice"
+        assert urlsplit(derived["SOCKET_IO_MANAGER_URL"]).username == "alice"
+
+    def test_tls_reaches_both_the_sentinels_and_the_master(self):
+        """SENTINEL_KWARGS covers only discovery. Carrying TLS there alone would
+        leave an encrypted discovery and a plaintext master; carrying it nowhere
+        — which is what this branch did — leaves a plaintext cache against a
+        TLS-only deployment while core encrypts both."""
+        env = {
+            "REDIS_SENTINEL_MODE": "true",
+            "REDIS_HOST": "sent",
+            "REDIS_SSL": "true",
+            "REDIS_SSL_CERT_REQS": "none",
+        }
+        options = _derive(**env)["CACHES"]["default"]["OPTIONS"]
+        assert self._core(**env)["ssl"] is True
+        for where in ("SENTINEL_KWARGS", "CONNECTION_POOL_KWARGS"):
+            assert options[where]["ssl"] is True, where
+            assert options[where]["ssl_cert_reqs"] == "none", where
+
+    def test_a_ca_reaches_both_too(self):
+        env = {
+            "REDIS_SENTINEL_MODE": "true",
+            "REDIS_HOST": "sent",
+            "REDIS_SSL": "true",
+            "REDIS_SSL_CA_CERTS": "/etc/ssl/ca.pem",
+        }
+        options = _derive(**env)["CACHES"]["default"]["OPTIONS"]
+        for where in ("SENTINEL_KWARGS", "CONNECTION_POOL_KWARGS"):
+            assert options[where]["ssl_ca_certs"] == "/etc/ssl/ca.pem", where
+
+    def test_no_tls_configured_adds_no_tls_keys(self):
+        """Flag off must leave the Sentinel cache byte-identical to before."""
+        options = _derive(REDIS_SENTINEL_MODE="true", REDIS_HOST="sent")["CACHES"][
+            "default"
+        ]["OPTIONS"]
+        assert options["SENTINEL_KWARGS"] == {}
+        assert options["CONNECTION_POOL_KWARGS"] == {}