diff --git a/docker/leoclean-nosend/Dockerfile b/docker/leoclean-nosend/Dockerfile
index 3eb30df..459cb16 100644
--- a/docker/leoclean-nosend/Dockerfile
+++ b/docker/leoclean-nosend/Dockerfile
@@ -34,6 +34,7 @@ LABEL org.opencontainers.image.source="https://github.com/living-ip/teleo-infras
       livingip.target="gcp-staging"
 
 COPY --from=python-build /usr/local /usr/local
+COPY --from=python-build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=python-build /opt/livingip/leoclean-nosend/venv /opt/livingip/leoclean-nosend/venv
 COPY artifact /opt/livingip/leoclean-nosend/artifact
 COPY identity /opt/livingip/leoclean-nosend/identity
@@ -47,6 +48,11 @@ COPY Dockerfile /opt/livingip/leoclean-nosend/metadata/Dockerfile
 COPY cloudsql-server-ca.pem /usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem
 
 RUN ln -s /usr/local/bin/python3.11 /usr/bin/python3 \
+  && test -d /usr/lib/ssl \
+  && if [ ! -L /usr/lib/ssl/cert.pem ] && [ ! -e /usr/lib/ssl/cert.pem ]; then \
+       ln -s /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem; \
+     fi \
+  && test "$(readlink -f /usr/lib/ssl/cert.pem)" = "/etc/ssl/certs/ca-certificates.crt" \
   && mkdir -p /usr/local/libexec/livingip/leoclean-kb/gcloud-config \
   && chmod 0755 /usr/local/libexec/livingip/leoclean-kb \
   && chmod 0555 /usr/local/libexec/livingip/leoclean-kb/gcloud-config \
@@ -61,6 +67,9 @@ RUN ln -s /usr/local/bin/python3.11 /usr/bin/python3 \
        test "${#digest}" -eq 64; \
      done \
   && test "$(/usr/local/bin/python3.11 -c 'import platform; print(platform.python_version())')" = "3.11.9" \
+  && test "$(/usr/local/bin/python3.11 -c 'import ssl; print(ssl.get_default_verify_paths().cafile)')" = "/usr/lib/ssl/cert.pem" \
+  && test "$(/usr/local/bin/python3.11 -c 'import ssl; print(ssl.get_default_verify_paths().cafile)')" != "/usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem" \
+  && /usr/local/bin/python3.11 -c 'import ssl; assert ssl.create_default_context().cert_store_stats().get("x509_ca", 0) > 0' \
   && /usr/bin/psql --version | grep -Eq '^psql \(PostgreSQL\) 16[.]14([[:space:]]|$)' \
   && test "$(sha256sum /usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem | cut -d ' ' -f 1)" = "80701e768f0e1f6b9d621aa0b53f6e851daaa276c6d9a8e51a300fbc015539cb" \
   && /opt/livingip/leoclean-nosend/venv/bin/python /opt/livingip/leoclean-nosend/entrypoint.py \
diff --git a/tests/test_gcp_leoclean_nosend_package.py b/tests/test_gcp_leoclean_nosend_package.py
index fd044b9..dc8c27a 100644
--- a/tests/test_gcp_leoclean_nosend_package.py
+++ b/tests/test_gcp_leoclean_nosend_package.py
@@ -2779,6 +2779,20 @@ def test_dockerfile_has_only_digest_pinned_bases_and_no_floating_package_install
     assert "identity -type f -exec chmod 0444" in dockerfile
 
 
+def test_image_restores_the_digest_pinned_default_tls_trust_contract() -> None:
+    dockerfile = (ROOT / "docker" / "leoclean-nosend" / "Dockerfile").read_text(encoding="utf-8")
+
+    assert (
+        "COPY --from=python-build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt"
+    ) in dockerfile
+    assert "[ ! -L /usr/lib/ssl/cert.pem ] && [ ! -e /usr/lib/ssl/cert.pem ]" in dockerfile
+    assert "ln -s /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem" in dockerfile
+    assert 'readlink -f /usr/lib/ssl/cert.pem)" = "/etc/ssl/certs/ca-certificates.crt"' in dockerfile
+    assert "ssl.get_default_verify_paths().cafile" in dockerfile
+    assert '!= "/usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem"' in dockerfile
+    assert "ssl.create_default_context().cert_store_stats()" in dockerfile
+
+
 def test_pid_one_command_line_accepts_only_native_and_exact_x86_64_binfmt_wrappers() -> None:
     native = [b"/runtime/python", b"/runtime/bootstrap.py", b"service", b""]
     binfmt = [native[0], *native]