We're trying to setup read replicas for our spicedb deployment, but keep running into url parsing errors

unable to instantiate datastore: cannot parse `postgresql://spicedb:xxxxxx@authz-replicas.spicedb.svc:5432/authz`: failed to parse as URL (net/url: invalid userinfo)

for context, we run postgres using the crunchy data operator. it sets up users and credentials and all that and drops them in a kubernetes secret. so to a fair degree, we don't control that. One well known problem with this operator is that it creates passwords with special charactres which can lead to url parsing problems and/or authentication problems if drivers don't support all of those chars for some reason. Occasionally there will be an

@

which we can work around by regenerating passwords. but there is very rarely, if ever an occurance where the password would be strictly alpha numeric. Is there a known or common way to handle this with spicedb and its underlying PG driver?