diff --git a/docker/Dockerfile b/docker/Dockerfile
index 28b6257..a4af169 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -14,6 +14,12 @@ RUN npm ci
 FROM node:22-alpine AS builder
 WORKDIR /app
 
+# sentry-cli (invoked by withSentryConfig during `npm run build` to upload
+# source maps) is a Rust binary that needs the system CA bundle to validate
+# GlitchTip's TLS cert — Alpine ships without one, causing "unable to get
+# local issuer certificate" and a failed upload.
+RUN apk add --no-cache ca-certificates
+
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .