diff --git a/internal/adapter/pkginstall/installer.go b/internal/adapter/pkginstall/installer.go
index f1e1693..0a7c967 100644
--- a/internal/adapter/pkginstall/installer.go
+++ b/internal/adapter/pkginstall/installer.go
@@ -43,6 +43,12 @@ const (
 const (
 	// aptInstallScript configures one signed source and verifies exact installed versions.
 	aptInstallScript = `set -eu
+case "$REPOSITORY_ROOT" in
+https://*)
+  apt-get update -qq
+  DEBIAN_FRONTEND=noninteractive apt-get install -y -qq ca-certificates >/dev/null
+  ;;
+esac
 rm -f /etc/apt/sources.list.d/*
 printf 'deb [signed-by=%s] %s/apt stable main\n' "$APT_KEY" "$REPOSITORY_ROOT" >/etc/apt/sources.list
 apt-get update -qq
diff --git a/internal/adapter/pkginstall/installer_test.go b/internal/adapter/pkginstall/installer_test.go
index e922d4b..f64f784 100644
--- a/internal/adapter/pkginstall/installer_test.go
+++ b/internal/adapter/pkginstall/installer_test.go
@@ -41,6 +41,7 @@ func TestVerifyRunsThreeSignedLocalClientsWithoutNetworking(t *testing.T) {
 	assert.Equal(t, 3, countArgument(arguments, "release-cli"))
 	joined := strings.Join(arguments, "\n")
 	assert.Contains(t, joined, "signed-by=%s")
+	assert.Contains(t, joined, "apt-get install -y -qq ca-certificates")
 	assert.Contains(t, joined, "gpgcheck=1")
 	assert.Contains(t, joined, "repo_gpgcheck=1")
 	assert.Contains(t, joined, "apk update")