diff --git a/start.sh b/start.sh
index 37ef70d..0587cef 100755
--- a/start.sh
+++ b/start.sh
@@ -41,7 +41,10 @@ ADD_HOST_FLAGS=(
   --add-host=dns1.sami:100.71.97.12
   --add-host=dc-contabo-de:100.98.123.59
   --add-host=git.dashcaddy.net:100.98.123.59
-  --add-host=ca.sami:127.0.0.1
+  # ca.sami resolves via DNS to 100.121.150.22 (Caddy on DNS2). Don't pin
+  # to 127.0.0.1 — nothing listens on 443 inside the container, so the
+  # health checker would fail with ECONNREFUSED. The CA itself is a
+  # public-facing service that goes through Caddy just like every other *.sami.
 )
 
 # Always recreate to ensure env vars are correct (CONFIG_FILE defaults to /etc/dashcaddy/ which doesn't exist)
@@ -74,6 +77,7 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
   -v /opt/sami-files/logs:/opt/sami-files/logs:ro \
   -v /usr/bin/tailscale:/usr/bin/tailscale:ro \
   -v /var/run/tailscale:/var/run/tailscale:ro \
+  -v /etc/ssl/sami-ca:/etc/ssl/sami-ca:ro \
   -e NODE_ENV=production \
   -e SERVICES_FILE=/app/data/services.json \
   -e CONFIG_FILE=/app/data/config.json \
@@ -88,4 +92,5 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
   -e ASSETS_DIR=/app/assets \
   -e DASHCADDY_API_SOURCE_DIR=/opt/dashcaddy/dashcaddy-api \
   -e DASHCADDY_UPDATE_ENABLED=false \
+  -e CA_CERT_PATH=/etc/ssl/sami-ca/root.crt \
   ${IMAGE}
\ No newline at end of file