diff --git a/crates/cuddle-ci/src/rust_service.rs b/crates/cuddle-ci/src/rust_service.rs
index ba19005..4f413c2 100644
--- a/crates/cuddle-ci/src/rust_service.rs
+++ b/crates/cuddle-ci/src/rust_service.rs
@@ -402,6 +402,7 @@ pub mod architecture {
 }
 
 mod apt;
+mod apt_ca_certificates;
 mod cargo_binstall;
 mod cargo_clean;
 mod clap_sanity_test;
@@ -410,6 +411,7 @@ mod sqlx;
 
 pub mod extensions {
     pub use super::apt::*;
+    pub use super::apt_ca_certificates::*;
     pub use super::cargo_binstall::*;
     pub use super::cargo_clean::*;
     pub use super::clap_sanity_test::*;
diff --git a/crates/cuddle-ci/src/rust_service/apt_ca_certificates.rs b/crates/cuddle-ci/src/rust_service/apt_ca_certificates.rs
new file mode 100644
index 0000000..ca9a85c
--- /dev/null
+++ b/crates/cuddle-ci/src/rust_service/apt_ca_certificates.rs
@@ -0,0 +1,49 @@
+use std::sync::Arc;
+
+use async_trait::async_trait;
+use dagger_sdk::Container;
+
+use crate::dagger_middleware::DaggerMiddleware;
+
+use super::RustService;
+
+pub struct AptCaCertificates {}
+
+impl AptCaCertificates {
+    pub fn new() -> Self {
+        Self {}
+    }
+}
+
+#[async_trait]
+impl DaggerMiddleware for AptCaCertificates {
+    async fn handle(&self, container: Container) -> eyre::Result<Container> {
+        let c = container
+            .with_exec(vec![
+                "apt",
+                "install",
+                "-y",
+                "ca-certificates",
+                "build-essential",
+                "curl",
+                "libssl-dev",
+            ])
+            .with_exec(vec!["update-ca-certificates"]);
+
+        Ok(c)
+    }
+}
+
+pub trait AptCaCertificatesExt {
+    fn with_apt_ca_certificates(&mut self, deps: &[&str]) -> &mut Self {
+        self
+    }
+}
+
+impl AptCaCertificatesExt for RustService {
+    fn with_apt_ca_certificates(&mut self, deps: &[&str]) -> &mut Self {
+        self.with_stage(super::RustServiceStage::BeforeDeps(Arc::new(
+            AptCaCertificates::new(),
+        )))
+    }
+}