diff --git a/docker/Dockerfile b/docker/Dockerfile
index a4af169..47119a3 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -15,10 +15,13 @@ FROM node:22-alpine AS builder
 WORKDIR /app
 
 # sentry-cli (invoked by withSentryConfig during `npm run build` to upload
-# source maps) is a Rust binary that needs the system CA bundle to validate
-# GlitchTip's TLS cert — Alpine ships without one, causing "unable to get
-# local issuer certificate" and a failed upload.
+# source maps) is a Rust binary whose vendored OpenSSL doesn't reliably
+# autodetect Alpine's CA bundle location, causing "unable to get local
+# issuer certificate" against GlitchTip's TLS cert. Install the bundle and
+# point SSL_CERT_FILE/SSL_CERT_DIR at it explicitly.
 RUN apk add --no-cache ca-certificates
+ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
+ENV SSL_CERT_DIR=/etc/ssl/certs
 
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .