diff --git a/krebs/2configs/default.nix b/krebs/2configs/default.nix
index c3400e171..90aaa254a 100644
--- a/krebs/2configs/default.nix
+++ b/krebs/2configs/default.nix
@@ -4,6 +4,13 @@ with import <stockholm/lib>;
 {
   imports = [
     ./backup.nix
+    (let ca-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; in {
+      environment.variables = {
+        CURL_CA_BUNDLE = ca-bundle;
+        GIT_SSL_CAINFO = ca-bundle;
+        SSL_CERT_FILE = ca-bundle;
+      };
+    })
   ];
   krebs.announce-activation.enable = true;
   krebs.enable = true;