diff --git a/Dockerfile b/Dockerfile
index 99e680cd..4e8ae711 100755
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,6 +40,8 @@ FROM ${BASE_IMAGE}
 
 WORKDIR /app
 
+# ubi9-micro doesn't include CA certificates; copy from builder for TLS (e.g. Google Pub/Sub)
+COPY --from=builder /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
 COPY --from=builder /build/bin/hyperfleet-api /app/hyperfleet-api
 COPY --from=builder /build/openapi/openapi.yaml /app/openapi/openapi.yaml