diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 5b23f89..06d435a 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -21,7 +21,20 @@ jobs:
       REPO: ${{ gitea.repository }}
       SHA: ${{ gitea.sha }}
     steps:
+      # Trust the home CA when one is configured: instance variable HOME_CA
+      # holds the root cert as PEM. Leave it unset on hosts with a public
+      # cert (the VPS) and this step is skipped.
+      - name: Trust home CA
+        if: ${{ vars.HOME_CA != '' }}
+        env:
+          HOME_CA: ${{ vars.HOME_CA }}
+        run: |
+          printf '%s\n' "$HOME_CA" > /usr/local/share/ca-certificates/home-ca.crt
+          update-ca-certificates
+
       - uses: actions/checkout@v4
+        env:
+          NODE_EXTRA_CA_CERTS: /etc/ssl/certs/ca-certificates.crt
 
       # node:24-trixie (Debian 13) has git and node but no Docker CLI. Install
       # the CLI and buildx from Docker's apt repo; the daemon is the runner's.