@@ -11,11 +11,13 @@ on:
       - v[0-9]+.x
     paths:
       - '**.nix'
+      - tools/certdata.txt
       - tools/nix/**
       - .github/workflows/nix-changes.yml
   pull_request:
     paths:
       - '**.nix'
+      - tools/certdata.txt
       - tools/nix/**
       - .github/workflows/nix-changes.yml
     types: [opened, synchronize, reopened, ready_for_review]
@@ -52,6 +54,7 @@ jobs:
           sparse-checkout: |
             shell.nix
             tools/nix/
+            tools/certdata.txt
           sparse-checkout-cone-mode: false
 
       - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b  # v31.11.3
 
@@ -149,6 +149,14 @@ pkgs.mkShell {
         )
       )
     );
+
+    # CA bundle built from the vendored Mozilla trust store, so Nix-built tools
+    # (curl, git, shared OpenSSL) don't fall back to the user's possibly stale one.
+    NIX_SSL_CERT_FILE = "${
+      pkgs.cacert.overrideAttrs {
+        src = ./tools/certdata.txt;
+      }
+    }/etc/ssl/certs/ca-bundle.crt";
   }
   // (
     let
Original file line number	Diff line number	Diff line change
`@@ -149,6 +149,14 @@ pkgs.mkShell {`
`149`	`149`	`)`
`150`	`150`	`)`
`151`	`151`	`);`
	`152`	`+`
	`153`	`+ # CA bundle built from the vendored Mozilla trust store, so Nix-built tools`
	`154`	`+ # (curl, git, shared OpenSSL) don't fall back to the user's possibly stale one.`
	`155`	`+ NIX_SSL_CERT_FILE = "${`
	`156`	`+ pkgs.cacert.overrideAttrs {`
	`157`	`+ src = ./tools/certdata.txt;`
	`158`	`+ }`
	`159`	`+ }/etc/ssl/certs/ca-bundle.crt";`
`152`	`160`	`}`
`153`	`161`	`// (`
`154`	`162`	`let`