diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml
index 1da3dc5..66c2a20 100644
--- a/.gitea/workflows/container.yml
+++ b/.gitea/workflows/container.yml
@@ -22,7 +22,9 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Fetch AtlasHorizon CAs
-        run: sh scripts/refresh-certs.sh
+        run: |
+          sh scripts/refresh-certs.sh
+          ls -l certs/*.crt
 
       - name: Registry and image names
         run: |
@@ -69,6 +71,8 @@ jobs:
           username: ${{ secrets.REGISTRY_USERNAME || github.actor }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
+      # source: . is required so gitignored certs from refresh-certs.sh
+      # are in the build context. The default Git context only has the commit.
       - name: Build and push
         uses: docker/bake-action@v6
         env:
@@ -77,6 +81,7 @@ jobs:
           SHA: ${{ env.SHA }}
           MANUAL: ${{ env.MANUAL }}
         with:
+          source: .
           files: docker-bake.hcl
           push: ${{ github.event_name != 'pull_request' }}
           provenance: false
diff --git a/Dockerfile b/Dockerfile
index 1b588bb..63c86a9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,9 @@
 ARG BASE_IMAGE=debian:trixie-slim
 FROM ${BASE_IMAGE}
 
-COPY certs/*.crt /tmp/atlas-ca/
+COPY certs/AtlasHorizon-Root-CA.crt \
+     certs/AtlasHorizon-Enterprise-CA.crt \
+     certs/AtlasHorizon-Issuing-CA.crt \
+     /tmp/atlas-ca/
 COPY scripts/install-ca.sh /tmp/install-ca.sh
 RUN sh /tmp/install-ca.sh && rm -rf /tmp/install-ca.sh /tmp/atlas-ca
diff --git a/README.md b/README.md
index db2fd97..2dc03cb 100644
--- a/README.md
+++ b/README.md
@@ -29,7 +29,7 @@ FROM git.atlashorizon.net/atlashorizon/container-base/alpine:3.24
 - Enterprise: `http://pki.atlashorizon.net/certs/AtlasHorizon%20Enterprise%20CA.crt`
 - Issuing: `http://pki.atlashorizon.net/certs/AtlasHorizon%20Issuing%20CA.crt`
 
-into `certs/AtlasHorizon-*-CA.crt`. Those files are gitignored. The Gitea Action runs the script after checkout so every image build embeds the current CAs.
+into `certs/AtlasHorizon-*-CA.crt`. Those files are gitignored. The Gitea Action runs the script after checkout and builds from the local workspace (`source: .`) so the fetched PEMs are actually in the image. The default Bake Git context would omit them.
 
 Locally: