diff --git a/.gitignore b/.gitignore
index 0ec0c0f..db1b685 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,5 @@ cli-&-go-sdk-implementation-plan.md
 design.md
 kafka-management-tasks.md
 .claude/
+
+*.pem
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index d24835e..ecc7300 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,12 +1,17 @@
 FROM golang:1.26 AS build
 WORKDIR /src
 ENV GOPRIVATE=forgejo.riotpiao.homelab.com
+# forgejo.riotpiao.homelab.com's cert is signed by a homelab-private CA, not
+# a public one -- without this, `go mod download` can't fetch kmsvc-proto.
+COPY hack/homelab-ca.pem /usr/local/share/ca-certificates/homelab-ca.crt
+RUN update-ca-certificates
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 go build -trimpath -o /out/kmsvc-server ./cmd/server
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o /out/kmsvc-server ./cmd/server
 
 FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=build /out/kmsvc-server /kmsvc-server
 USER nonroot:nonroot
 ENTRYPOINT ["/kmsvc-server"]
diff --git a/Dockerfile.queue-operator b/Dockerfile.queue-operator
index 0922b49..2fbea99 100644
--- a/Dockerfile.queue-operator
+++ b/Dockerfile.queue-operator
@@ -1,10 +1,12 @@
 FROM golang:1.26 AS build
 WORKDIR /src
 ENV GOPRIVATE=forgejo.riotpiao.homelab.com
+COPY hack/homelab-ca.pem /usr/local/share/ca-certificates/homelab-ca.crt
+RUN update-ca-certificates
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 go build -trimpath -o /out/queue-operator ./cmd/queue-operator
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o /out/queue-operator ./cmd/queue-operator
 
 FROM gcr.io/distroless/static-debian12:nonroot
 COPY --from=build /out/queue-operator /queue-operator