diff --git a/.ci/build-packages.sh b/.ci/build-packages.sh
index 39289047..c391465a 100755
--- a/.ci/build-packages.sh
+++ b/.ci/build-packages.sh
@@ -29,6 +29,9 @@ else
     export SLACK_CHANNEL="#team-vagrant-spam-channel"
 fi
 
+# Grab a recent cacert bundle
+curl -O https://curl.se/ca/cacert.pem
+
 # Define a custom cleanup function to destroy any orphan guests
 # on the packet instance
 function cleanup() {
diff --git a/substrate/run.sh b/substrate/run.sh
index 7aed9fc7..758faede 100755
--- a/substrate/run.sh
+++ b/substrate/run.sh
@@ -38,6 +38,10 @@ function echo_stderr {
     (>&2 echo "$@")
 }
 
+# Set curl to use updated cert bundle
+echo "cacert = /vagrant/cacert.pem" > ~/.curlrc
+echo "capath = /usr" >> ~/.curlrc
+
 set -e
 
 # Verify arguments