diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5bbe736..ca6b37d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [Unreleased]
+
+### Added
+
+- Support for `SSL_CERT_FILE` and `SSL_CERT_DIR` environment variables for
+  custom CA store.
+
 ## [0.9] - 2026-07-18
 
 [0.9]: https://github.com/ccache/ccache-storage-http-cpp/releases/tag/v0.9
diff --git a/README.md b/README.md
index f47e0ed..efef5ca 100644
--- a/README.md
+++ b/README.md
@@ -130,6 +130,14 @@ export CCACHE_REMOTE_STORAGE="https://cache.example.com @use-netrc"
 export CCACHE_REMOTE_STORAGE="https://cache.example.com @netrc-file=/path/to/my-netrc"
 ```
 
+### Custom CA store
+
+Set `SSL_CERT_FILE` to a CA certificate bundle or `SSL_CERT_DIR` to a CA
+certificate directory to override the CA store used for HTTPS requests.
+
+Note: The helper process is spawned by ccache, so these variables must be set
+before ccache is invoked.
+
 ## Optional debug logging
 
 You can set the `CRSH_LOGFILE` environment variable to enable debug logging to a
diff --git a/src/config.cpp b/src/config.cpp
index 80358c9..23dbcbe 100644
--- a/src/config.cpp
+++ b/src/config.cpp
@@ -69,6 +69,16 @@ std::optional<Config> parse_config()
   config.idle_timeout_seconds = *idle_val;
   LOG("Idle timeout: " + std::to_string(config.idle_timeout_seconds));
 
+  const char* ssl_cert_file = std::getenv("SSL_CERT_FILE");
+  if (ssl_cert_file && ssl_cert_file[0] != '\0') {
+    config.ssl_cert_file = ssl_cert_file;
+  }
+
+  const char* ssl_cert_dir = std::getenv("SSL_CERT_DIR");
+  if (ssl_cert_dir && ssl_cert_dir[0] != '\0') {
+    config.ssl_cert_dir = ssl_cert_dir;
+  }
+
   const char* num_attr_str = std::getenv("CRSH_NUM_ATTR");
   if (!num_attr_str || num_attr_str[0] == '\0') {
     num_attr_str = "0";
diff --git a/src/config.hpp b/src/config.hpp
index 69527e0..359bc26 100644
--- a/src/config.hpp
+++ b/src/config.hpp
@@ -28,6 +28,10 @@ struct Config
   std::vector<std::pair<std::string, std::string>> headers;
   bool use_netrc = false;
   std::optional<std::string> netrc_file;
+
+  // TLS certificate store overrides from the environment.
+  std::optional<std::string> ssl_cert_file;
+  std::optional<std::string> ssl_cert_dir;
 };
 
 std::optional<Config> parse_config();
diff --git a/src/storage_client.cpp b/src/storage_client.cpp
index e291cab..9dbc8bd 100644
--- a/src/storage_client.cpp
+++ b/src/storage_client.cpp
@@ -280,6 +280,14 @@ CURL* StorageClient::create_easy_handle(HttpRequest* request)
   curl_easy_setopt(handle, CURLOPT_WRITEDATA, request);
   curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, write_callback);
 
+  if (_config.ssl_cert_file) {
+    curl_easy_setopt(handle, CURLOPT_CAINFO, _config.ssl_cert_file->c_str());
+  }
+
+  if (_config.ssl_cert_dir) {
+    curl_easy_setopt(handle, CURLOPT_CAPATH, _config.ssl_cert_dir->c_str());
+  }
+
   if (_config.use_netrc) {
     curl_easy_setopt(handle, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
     if (_config.netrc_file) {