When should you pin the SSH host key fingerprint on a connection?

Pin it whenever the tunnel crosses a network you don't fully control – essentially any bastion reachable over the internet or a shared network – because leaving the fingerprint blank means the bastion's identity is never actually verified; BetterDB just logs a warning and connects anyway.

Setting the SHA256:... fingerprint makes the tunnel refuse to connect unless the bastion presents a matching key, which closes off a man-in-the-middle path onto that hop.

It's less critical when the bastion is only reachable over an already-trusted private network path, but it's still good practice there too, since fingerprint pinning costs nothing to configure once and only helps.

Getting the fingerprint is a one-time step – you can read it directly off the bastion with a command like ssh-keyscan or from the host's own /etc/ssh keys – and pasting it into the connection means every future tunnel attempt is checked against that known-good value automatically, rather than relying on someone noticing a changed key by chance.