diff --git a/apps/base/cephrgw-system/deployment.yaml b/apps/base/cephrgw-system/deployment.yaml
index 3ccfbfa..6f99a79 100644
--- a/apps/base/cephrgw-system/deployment.yaml
+++ b/apps/base/cephrgw-system/deployment.yaml
@@ -36,6 +36,17 @@ spec:
             # Vault per docs/ceph-setup.md; not managed in GitOps.
             - secretRef:
                 name: cephrgw-credentials
+          env:
+            # Trust the internal unkin.net (Vault PKI) CA so the operator can
+            # verify radosgw's TLS cert. vault-ca-cert is reflected into every
+            # namespace from the certificates namespace.
+            - name: CEPH_RGW_CA_FILE
+              value: /etc/vault-ca/ca.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /etc/vault-ca/ca.crt
+              subPath: ca.crt
+              readOnly: true
           ports:
             - containerPort: 8080
               name: metrics
@@ -65,3 +76,7 @@ spec:
             limits:
               cpu: 500m
               memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert