diff --git a/Containers/talk/start.sh b/Containers/talk/start.sh
index f89949f3..003e9a89 100644
--- a/Containers/talk/start.sh
+++ b/Containers/talk/start.sh
@@ -18,6 +18,21 @@ elif [ -z "$INTERNAL_SECRET" ]; then
     exit 1
 fi
 
+# Trust additional CA certificates, if the user provided NEXTCLOUD_TRUSTED_CACERTS_DIR
+# The container is read-only, so we build a custom bundle in /tmp (tmpfs) and
+# point Go's TLS stack to it via SSL_CERT_FILE.
+if [ -n "$(find /usr/local/share/ca-certificates -name '*.crt' -type f 2>/dev/null)" ]; then
+    echo "Trusting additional CA certificates..."
+    cp /etc/ssl/certs/ca-certificates.crt /tmp/ca-certificates.crt
+    for cert in /usr/local/share/ca-certificates/*.crt; do
+        if [ -f "$cert" ]; then
+            cat "$cert" >> /tmp/ca-certificates.crt
+            echo "  Added: $(basename "$cert")"
+        fi
+    done
+    export SSL_CERT_FILE=/tmp/ca-certificates.crt
+fi
+
 set -x
 IPv4_ADDRESS_TALK_RELAY="$(hostname -i | grep -oP '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
 # shellcheck disable=SC2153
diff --git a/php/containers.json b/php/containers.json
index a72d19a2..2e1923c0 100644
--- a/php/containers.json
+++ b/php/containers.json
@@ -437,6 +437,13 @@
         "8081"
       ],
       "internal_port": "%TALK_PORT%",
+      "volumes": [
+        {
+          "source": "%NEXTCLOUD_TRUSTED_CACERTS_DIR%",
+          "destination": "/usr/local/share/ca-certificates",
+          "writeable": false
+        }
+      ],
       "environment": [
         "NC_DOMAIN=%NC_DOMAIN%",
         "TALK_HOST=nextcloud-aio-talk",