diff --git a/apps/desktop/src/shell/DesktopShellEnvironment.test.ts b/apps/desktop/src/shell/DesktopShellEnvironment.test.ts
index 677eb44a8f93e3a5bac0be804efc588b239af0ae..6efe817574a34beba449bdbafbb43bd82ea2fce4 100644
--- a/apps/desktop/src/shell/DesktopShellEnvironment.test.ts
+++ b/apps/desktop/src/shell/DesktopShellEnvironment.test.ts
@@ -367,6 +367,32 @@ describe("DesktopShellEnvironment", () => {
     }),
   );
 
+  it.effect("hydrates missing CA trust variables from the login shell", () =>
+    Effect.gen(function* () {
+      const env: NodeJS.ProcessEnv = {
+        SHELL: "/bin/zsh",
+        PATH: "/usr/bin",
+        SSL_CERT_DIR: "/etc/ssl/certs",
+      };
+
+      yield* runShellEnvironment({
+        env,
+        platform: "darwin",
+        handler: () =>
+          envOutput({
+            PATH: "/opt/zerobrew/bin:/usr/bin",
+            SSL_CERT_FILE: "/opt/zerobrew/etc/ca-certificates/cacert.pem",
+            SSL_CERT_DIR: "/opt/zerobrew/etc/ca-certificates",
+            NODE_EXTRA_CA_CERTS: "/Users/me/corp-root.pem",
+          }),
+      });
+
+      assert.equal(env.SSL_CERT_FILE, "/opt/zerobrew/etc/ca-certificates/cacert.pem");
+      assert.equal(env.SSL_CERT_DIR, "/etc/ssl/certs");
+      assert.equal(env.NODE_EXTRA_CA_CERTS, "/Users/me/corp-root.pem");
+    }),
+  );
+
   it.effect("keeps mise's PATH record with the login shell PATH", () =>
     Effect.gen(function* () {
       const env: NodeJS.ProcessEnv = {
diff --git a/apps/desktop/src/shell/DesktopShellEnvironment.ts b/apps/desktop/src/shell/DesktopShellEnvironment.ts
index ebf5abfdc9f8437e8c4f30071b26305f256f81c1..2b41b6ea7db94daaee603c9a9d287c242951bfe9 100644
--- a/apps/desktop/src/shell/DesktopShellEnvironment.ts
+++ b/apps/desktop/src/shell/DesktopShellEnvironment.ts
@@ -86,6 +86,9 @@ const LOGIN_SHELL_ENV_NAMES = [
   "XDG_SESSION_DESKTOP",
   "XDG_SESSION_TYPE",
   "WAYLAND_DISPLAY",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  "NODE_EXTRA_CA_CERTS",
   "T3CODE_TELEMETRY_ENABLED",
   "__MISE_DIFF",
 ] as const;
@@ -454,6 +457,12 @@ const installPosixEnvironment = Effect.fn("desktop.shellEnvironment.installPosix
       "XDG_DATA_HOME",
       "XDG_RUNTIME_DIR",
       "WAYLAND_DISPLAY",
+      // CA trust set in the shell profile. Without it, a Node or OpenSSL build
+      // that has no bundled roots (a shared-OpenSSL node on PATH) cannot verify
+      // TLS, so provider updaters and agents fail to reach their registries.
+      "SSL_CERT_FILE",
+      "SSL_CERT_DIR",
+      "NODE_EXTRA_CA_CERTS",
       // The telemetry opt-out is documented as a shell variable; GUI launches never see it.
       "T3CODE_TELEMETRY_ENABLED",
     ] as const) {