diff --git a/.github/workflows/nix-changes.yml b/.github/workflows/nix-changes.yml
index 85fba6798bc..45640902d5a 100644
--- a/.github/workflows/nix-changes.yml
+++ b/.github/workflows/nix-changes.yml
@@ -11,11 +11,13 @@ on:
       - v[0-9]+.x
     paths:
       - '**.nix'
+      - tools/certdata.txt
       - tools/nix/**
       - .github/workflows/nix-changes.yml
   pull_request:
     paths:
       - '**.nix'
+      - tools/certdata.txt
       - tools/nix/**
       - .github/workflows/nix-changes.yml
     types: [opened, synchronize, reopened, ready_for_review]
@@ -52,6 +54,7 @@ jobs:
           sparse-checkout: |
             shell.nix
             tools/nix/
+            tools/certdata.txt
           sparse-checkout-cone-mode: false
 
       - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b  # v31.11.3
diff --git a/shell.nix b/shell.nix
index cb5f0a8f102..a42f70ed7b5 100644
--- a/shell.nix
+++ b/shell.nix
@@ -149,6 +149,14 @@ pkgs.mkShell {
         )
       )
     );
+
+    # CA bundle built from the vendored Mozilla trust store, so Nix-built tools
+    # (curl, git, shared OpenSSL) don't fall back to the user's possibly stale one.
+    NIX_SSL_CERT_FILE = "${
+      pkgs.cacert.overrideAttrs {
+        src = ./tools/certdata.txt;
+      }
+    }/etc/ssl/certs/ca-bundle.crt";
   }
   // (
     let