diff --git a/tools/build b/tools/build
index e40cb0d..f2acfec 100755
--- a/tools/build
+++ b/tools/build
@@ -64,6 +64,15 @@ def _make_session(retries: int = 3, backoff_factor: float = 0.5) -> requests.Ses
 _gitea_session = _make_session()
 _github_session = _make_session()
 _artifactapi_session = _make_session()
+# artifactapi serves an internally-signed TLS cert. Verify against the OS CA
+# bundle (which includes the internal CA, as dnf/curl in the builder images do)
+# rather than certifi's Mozilla bundle, which does not trust it.
+_artifactapi_session.verify = os.getenv('ARTIFACTAPI_CA_BUNDLE') or next(
+    (p for p in ('/etc/pki/tls/certs/ca-bundle.crt',
+                 '/etc/ssl/certs/ca-certificates.crt')
+     if os.path.exists(p)),
+    True,
+)
 
 
 # ==================== VALIDATION SCHEMA ====================