@@ -141,6 +141,18 @@ pub const UPSTREAM_PROXY_AUTH_MOUNT_PATH: &str = "/etc/openshell/auth/upstream-p
 /// mount is used rather than a driver secret.
 pub const PROXY_CA_MOUNT_PATH: &str = "/etc/openshell/tls/proxy/ca-bundle.pem";
 
+/// Container-side mount path for an operator-supplied additional destination
+/// CA bundle.
+///
+/// Drivers with an `additional_ca_bundle` operator setting bind-mount the
+/// host PEM file here (read-only) and pass the path on the supervisor's argv
+/// via `--additional-ca-bundle`. The supervisor folds it into its upstream
+/// TLS trust store alongside the system CA bundle, for direct (non-proxied)
+/// inspected HTTPS egress to destinations signed by a private CA — unlike
+/// [`PROXY_CA_MOUNT_PATH`], this applies regardless of whether a corporate
+/// forward proxy is configured.
+pub const ADDITIONAL_CA_MOUNT_PATH: &str = "/etc/openshell/tls/additional/ca-bundle.pem";
+
 /// A validated corporate upstream-proxy address.
 ///
 /// Produced by [`parse_upstream_proxy_url`], which is the single source of
 
@@ -50,6 +50,7 @@ url = { workspace = true }
 openshell-otel-test-support = { path = "../openshell-otel-test-support" }
 opentelemetry_sdk = { workspace = true, features = ["testing"] }
 prost-types = { workspace = true }
+rcgen = { workspace = true }
 temp-env = "0.3"
 tempfile = "3"
 tokio = { workspace = true, features = ["test-util"] }
 
@@ -176,6 +176,23 @@ pub struct PodmanComputeConfig {
     /// and upstream verification. Only meaningful with `https_proxy` set; the
     /// bundle must exist and contain at least one certificate.
     pub proxy_ca_bundle: Option<String>,
+    /// Path (on the gateway host) to a PEM CA bundle trusted for direct
+    /// (non-proxied), policy-inspected HTTPS egress to destinations signed by
+    /// a private CA.
+    ///
+    /// Unlike [`proxy_ca_bundle`](Self::proxy_ca_bundle), this applies
+    /// regardless of whether `https_proxy` is configured: it addresses
+    /// supervisors that run as their own container, separate from the
+    /// workload image, and therefore cannot inherit a private CA baked into
+    /// the workload's system trust store. The gateway bind-mounts this file
+    /// read-only into the supervisor container (at
+    /// [`ADDITIONAL_CA_MOUNT_PATH`](openshell_core::driver_utils::ADDITIONAL_CA_MOUNT_PATH))
+    /// and passes its path via `--additional-ca-bundle`. The supervisor folds
+    /// it into its upstream TLS trust store alongside (not instead of) the
+    /// system CA bundle. The bundle must exist and contain at least one
+    /// certificate; this is validated on the gateway host at sandbox-create
+    /// time, not deferred until the supervisor container starts.
+    pub additional_ca_bundle: Option<String>,
     /// User namespace mode for sandbox containers (e.g. `auto`, `private`).
     /// When unset, containers use the default user namespace.
     pub userns: Option<String>,
@@ -340,6 +357,21 @@ impl PodmanComputeConfig {
                 ));
             }
         }
+        // additional_ca_bundle is independent of the corporate proxy setting
+        // above: it applies to direct, inspected egress and has no
+        // https_proxy dependency. Read and validate the actual host file
+        // here (this path is not yet mounted into any container), rather
+        // than only checking it is non-empty: an operator with a mistyped
+        // path or a certificate-free bundle should see a config-validation
+        // error at sandbox-create time, not a failed/crash-looping sandbox
+        // once the supervisor container starts and tries to read it.
+        if let Some(path) = self.additional_ca_bundle.as_deref() {
+            openshell_core::driver_utils::read_upstream_proxy_ca_bundle_file(
+                path,
+                "additional_ca_bundle",
+            )
+            .map_err(crate::client::PodmanApiError::InvalidInput)?;
+        }
         Ok(())
     }
 
@@ -526,6 +558,7 @@ impl Default for PodmanComputeConfig {
             proxy_auth_allow_insecure: None,
             proxy_connect_by_hostname: None,
             proxy_ca_bundle: None,
+            additional_ca_bundle: None,
             userns: None,
             uidmap: Vec::new(),
             gidmap: Vec::new(),
@@ -839,6 +872,65 @@ mod tests {
         assert!(err.to_string().contains("proxy_ca_bundle"), "{err}");
     }
 
+    #[test]
+    fn validate_configuration_accepts_additional_ca_bundle_without_proxy() {
+        // #3781: unlike proxy_ca_bundle, this must work with no corporate
+        // proxy configured at all.
+        let directory = tempfile::tempdir().unwrap();
+        let ca_path = directory.path().join("additional-ca.pem");
+        std::fs::write(&ca_path, generate_test_ca_pem()).unwrap();
+
+        let cfg = PodmanComputeConfig {
+            additional_ca_bundle: Some(ca_path.to_str().unwrap().to_string()),
+            ..PodmanComputeConfig::default()
+        };
+        assert!(cfg.validate_proxy_config().is_ok());
+        assert!(cfg.https_proxy.is_none());
+    }
+
+    #[test]
+    fn validate_configuration_rejects_empty_additional_ca_bundle() {
+        let cfg = PodmanComputeConfig {
+            additional_ca_bundle: Some("  ".to_string()),
+            ..PodmanComputeConfig::default()
+        };
+        let err = cfg.validate_proxy_config().unwrap_err();
+        assert!(err.to_string().contains("additional_ca_bundle"), "{err}");
+    }
+
+    #[test]
+    fn validate_configuration_rejects_nonexistent_additional_ca_bundle() {
+        // #3781 fix requirement: an operator with a mistyped path must see
+        // this at config-validation time, not a failed sandbox later.
+        let cfg = PodmanComputeConfig {
+            additional_ca_bundle: Some("/nonexistent/additional-ca.pem".to_string()),
+            ..PodmanComputeConfig::default()
+        };
+        let err = cfg.validate_proxy_config().unwrap_err();
+        assert!(err.to_string().contains("additional_ca_bundle"), "{err}");
+    }
+
+    #[test]
+    fn validate_configuration_rejects_certificate_free_additional_ca_bundle() {
+        let directory = tempfile::tempdir().unwrap();
+        let ca_path = directory.path().join("not-a-cert.pem");
+        std::fs::write(&ca_path, "not a certificate\n").unwrap();
+
+        let cfg = PodmanComputeConfig {
+            additional_ca_bundle: Some(ca_path.to_str().unwrap().to_string()),
+            ..PodmanComputeConfig::default()
+        };
+        let err = cfg.validate_proxy_config().unwrap_err();
+        assert!(err.to_string().contains("additional_ca_bundle"), "{err}");
+    }
+
+    /// Generate a real, valid self-signed CA certificate PEM for tests.
+    fn generate_test_ca_pem() -> String {
+        let key_pair = rcgen::KeyPair::generate().unwrap();
+        let params = rcgen::CertificateParams::new(Vec::new()).unwrap();
+        params.self_signed(&key_pair).unwrap().pem()
+    }
+
     #[test]
     fn validate_proxy_config_rejects_url_components() {
         for url in [
 
@@ -67,6 +67,7 @@ const UPSTREAM_PROXY_AUTH_MOUNT_PATH: &str =
     openshell_core::driver_utils::UPSTREAM_PROXY_AUTH_MOUNT_PATH;
 const RESOLV_CONF_PATH: &str = "/etc/resolv.conf";
 const PROXY_CA_MOUNT_PATH: &str = openshell_core::driver_utils::PROXY_CA_MOUNT_PATH;
+const ADDITIONAL_CA_MOUNT_PATH: &str = openshell_core::driver_utils::ADDITIONAL_CA_MOUNT_PATH;
 const PROVIDER_SPIFFE_WORKLOAD_API_SOCKET_MOUNT_DIR: &str =
     openshell_core::driver_utils::PROVIDER_SPIFFE_WORKLOAD_API_SOCKET_MOUNT_DIR;
 
@@ -515,6 +516,19 @@ fn upstream_proxy_cli_args(config: &PodmanComputeConfig) -> Vec<String> {
     args
 }
 
+/// Build the additional-destination-CA command-line argument passed to the
+/// supervisor. Independent of `upstream_proxy_cli_args`: this applies to
+/// direct, inspected egress regardless of whether a corporate proxy is
+/// configured.
+fn additional_ca_cli_args(config: &PodmanComputeConfig) -> Vec<String> {
+    let mut args = Vec::new();
+    if config.additional_ca_bundle.is_some() {
+        args.push("--additional-ca-bundle".to_string());
+        args.push(ADDITIONAL_CA_MOUNT_PATH.to_string());
+    }
+    args
+}
+
 fn build_env(
     sandbox: &DriverSandbox,
     config: &PodmanComputeConfig,
@@ -1178,6 +1192,7 @@ fn build_base_spec(
         driver_mounts::DEFAULT_WORKSPACE_ROOT.to_string(),
     ];
     command.extend(upstream_proxy_cli_args(config));
+    command.extend(additional_ca_cli_args(config));
 
     let container_spec = ContainerSpec {
         name,
@@ -1371,6 +1386,24 @@ fn build_base_spec(
                     options: ro,
                 });
             }
+            // Bind-mount an operator-supplied additional destination CA
+            // bundle read-only when configured. Independent of the corporate
+            // proxy CA above: this applies to direct, inspected egress. The
+            // supervisor reads it via the --additional-ca-bundle argv path
+            // (see additional_ca_cli_args) and folds it into its upstream
+            // trust store alongside the system bundle.
+            if let Some(ca_bundle) = &config.additional_ca_bundle {
+                let mut ro = vec!["ro".into(), "rbind".into()];
+                if is_selinux_enabled() {
+                    ro.push("z".into());
+                }
+                m.push(Mount {
+                    kind: "bind".into(),
+                    source: ca_bundle.clone(),
+                    destination: ADDITIONAL_CA_MOUNT_PATH.into(),
+                    options: ro,
+                });
+            }
             if let Some(bin_path) = supervisor_bin_path {
                 let mut opts = vec!["ro".into(), "rbind".into()];
                 if is_selinux_enabled() {
@@ -2671,6 +2704,70 @@ mod tests {
         );
     }
 
+    #[test]
+    fn container_spec_binds_additional_ca_bundle_and_passes_argv_without_proxy() {
+        // #3781: the additional CA must work for direct, inspected egress
+        // with no corporate proxy configured at all — unlike proxy_ca_bundle,
+        // which requires https_proxy.
+        let sandbox = test_sandbox("additional-ca-id", "additional-ca-name");
+        let mut config = test_config();
+        assert!(
+            config.https_proxy.is_none(),
+            "test must exercise the no-proxy case"
+        );
+        config.additional_ca_bundle = Some("/host/additional-ca.pem".to_string());
+
+        let spec = build_container_spec(&sandbox, &config);
+        let command = spec_command(&spec);
+
+        let idx = command
+            .iter()
+            .position(|a| a == "--additional-ca-bundle")
+            .expect("additional CA bundle flag present");
+        assert_eq!(
+            command.get(idx + 1).map(String::as_str),
+            Some("/etc/openshell/tls/additional/ca-bundle.pem")
+        );
+
+        let mounts = spec["mounts"]
+            .as_array()
+            .expect("mounts should be an array");
+        let ca_mount = mounts
+            .iter()
+            .find(|m| {
+                m["type"].as_str() == Some("bind")
+                    && m["destination"].as_str()
+                        == Some("/etc/openshell/tls/additional/ca-bundle.pem")
+            })
+            .expect("additional CA bundle bind mount present");
+        assert_eq!(ca_mount["source"].as_str(), Some("/host/additional-ca.pem"));
+        assert!(
+            ca_mount["options"]
+                .as_array()
+                .expect("options array")
+                .iter()
+                .any(|o| o.as_str() == Some("ro")),
+            "additional CA bundle mount must be read-only"
+        );
+    }
+
+    #[test]
+    fn container_spec_omits_additional_ca_bundle_when_unconfigured() {
+        let sandbox = test_sandbox("test-id", "test-name");
+        let spec = build_container_spec(&sandbox, &test_config());
+        let command = spec_command(&spec);
+        assert!(
+            !command.iter().any(|a| a == "--additional-ca-bundle"),
+            "no additional-ca-bundle flag without operator config"
+        );
+        let mounts = spec["mounts"].as_array().expect("mounts array");
+        assert!(
+            !mounts.iter().any(|m| m["destination"].as_str()
+                == Some("/etc/openshell/tls/additional/ca-bundle.pem")),
+            "no additional CA bundle mount without operator config"
+        );
+    }
+
     #[test]
     fn container_spec_sandbox_env_cannot_influence_proxy_argv() {
         use openshell_core::proto::compute::v1::{DriverSandboxSpec, DriverSandboxTemplate};
 
@@ -174,6 +174,14 @@ struct Args {
     #[arg(long, env = "OPENSHELL_SANDBOX_PROXY_CA_BUNDLE")]
     sandbox_proxy_ca_bundle: Option<String>,
 
+    /// Path (on the gateway host) to a PEM CA bundle trusted for direct
+    /// (non-proxied), policy-inspected HTTPS egress to destinations signed by
+    /// a private CA. Unlike `--sandbox-proxy-ca-bundle`, this applies
+    /// regardless of whether a corporate proxy is configured. Bind-mounted
+    /// read-only into the supervisor container.
+    #[arg(long, env = "OPENSHELL_SANDBOX_ADDITIONAL_CA_BUNDLE")]
+    sandbox_additional_ca_bundle: Option<String>,
+
     /// User namespace mode for sandbox containers (e.g. `auto`).
     /// When unset, containers use the default user namespace.
     #[arg(long, env = "OPENSHELL_PODMAN_USERNS")]
@@ -240,6 +248,7 @@ async fn main() -> Result<()> {
         proxy_auth_allow_insecure: args.sandbox_proxy_auth_allow_insecure,
         proxy_connect_by_hostname: args.sandbox_proxy_connect_by_hostname,
         proxy_ca_bundle: args.sandbox_proxy_ca_bundle,
+        additional_ca_bundle: args.sandbox_additional_ca_bundle,
         userns: args.userns,
         uidmap: args.uidmap,
         gidmap: args.gidmap,
 
@@ -585,11 +585,80 @@ mod tests {
         assert_eq!(config.alpn_protocols, vec![b"http/1.1".to_vec()]);
     }
 
+    /// Reproduces issue #3781 end to end with a real TLS handshake: an
+    /// upstream client trying to reach a destination signed by an
+    /// operator-owned private CA fails when that CA is unknown, and succeeds
+    /// once it is appended to the bundle passed to
+    /// `build_upstream_client_config` — the same mechanism the Podman driver
+    /// fix (`additional_ca_bundle`) feeds into. No fakes: a real rustls
+    /// `TlsAcceptor`/`TlsConnector` pair over a real loopback TCP connection.
+    #[tokio::test]
+    async fn additional_ca_enables_trust_of_privately_signed_upstream() {
+        let hostname = "private.example";
+
+        // A CA the system bundle has never heard of, standing in for the
+        // operator-owned private CA from #3781.
+        let private_ca = SandboxCa::generate().unwrap();
+        let private_ca_pem = private_ca.cert_pem().to_string();
+        let cert_cache = CertCache::new(private_ca);
+        let leaf = cert_cache.get_or_generate(hostname).unwrap();
+
+        let server_config = Arc::new(
+            ServerConfig::builder()
+                .with_no_client_auth()
+                .with_single_cert(leaf.cert_chain.clone(), leaf.private_key.clone_key())
+                .unwrap(),
+        );
+        let acceptor = TlsAcceptor::from(server_config);
+
+        // --- Without the private CA: must fail. This is the literal bug in
+        // #3781 — "Upstream TLS establishment failed" against a
+        // policy-allowed, private-CA-signed destination. ---
+        let addr = serve_one(acceptor.clone()).await;
+        let client_without = build_upstream_client_config("").unwrap();
+        let tcp = tokio::net::TcpStream::connect(addr).await.unwrap();
+        let result = tls_connect_upstream(tcp, hostname, &client_without).await;
+        assert!(
+            result.is_err(),
+            "connection to a privately-signed destination must fail when the \
+             private CA is not trusted, reproducing #3781"
+        );
+
+        // --- With the private CA appended to the bundle: must succeed. This
+        // is what additional_ca_bundle plumbs through in the Podman driver
+        // fix. ---
+        let addr = serve_one(acceptor).await;
+        let client_with = build_upstream_client_config(&private_ca_pem).unwrap();
+        let tcp = tokio::net::TcpStream::connect(addr).await.unwrap();
+        let result = tls_connect_upstream(tcp, hostname, &client_with).await;
+        assert!(
+            result.is_ok(),
+            "connection must succeed once the private CA is trusted: {:?}",
+            result.err()
+        );
+    }
+
     /// Helper: generate a self-signed CA and return its PEM string.
     fn generate_ca_pem() -> String {
         SandboxCa::generate().unwrap().ca_cert_pem
     }
 
+    /// Accept exactly one TLS connection on a fresh loopback listener and
+    /// return its address. Used by `additional_ca_enables_trust_of_...` to
+    /// give each connection attempt its own listener.
+    async fn serve_one(acceptor: TlsAcceptor) -> std::net::SocketAddr {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        tokio::spawn(async move {
+            let (stream, _) = listener.accept().await.unwrap();
+            // Don't unwrap: when the client (correctly) rejects an untrusted
+            // certificate, the server observes a failed handshake too. Only
+            // the client's outcome matters here.
+            let _ = acceptor.accept(stream).await;
+        });
+        addr
+    }
+
     #[test]
     fn load_pem_certs_single_ca() {
         let pem = generate_ca_pem();