diff --git a/Dockerfile b/Dockerfile
index 5d7d6e7..e91900a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -46,6 +46,10 @@ FROM gcr.io/distroless/static-debian12:nonroot
 # securityContext; if one changes, both must.
 USER 65532:65532
 
+# distroless/static has no CA certs. Copy them from the build stage so Go's
+# crypto/tls can verify the Kubernetes API server certificate.
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
 COPY --from=build /out/gateway /gateway
 
 EXPOSE 8080