diff --git a/Dockerfile.tmpl b/Dockerfile.tmpl
index 132bebf6..e6beb37e 100644
--- a/Dockerfile.tmpl
+++ b/Dockerfile.tmpl
@@ -56,6 +56,9 @@ RUN uv pip install --system --no-cache "pycuda"
 # as described by Lionel Chan at http://stackoverflow.com/a/37426929/5881346
 RUN sed -i "s/httpredir.debian.org/debian.uchicago.edu/" /etc/apt/sources.list && \
     apt-get update --allow-releaseinfo-change && \
+    # Debian's trixie-security ca-certificates 20250419+deb13u1 blocklists it in the system store.
+    # TODO(b/576329498): Remove upgrade to ca-certificates once the base image ships the newer version.
+    apt-get install --no-install-recommends -y --only-upgrade ca-certificates && \
     # Needed by lightGBM (GPU build)
     # https://lightgbm.readthedocs.io/en/latest/GPU-Tutorial.html#build-lightgbm
     apt-get install -y build-essential unzip cmake libboost-dev libboost-system-dev libboost-filesystem-dev p7zip-full && \