diff --git a/config/config.exs b/config/config.exs
index 79db457b..28cd9a3b 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -82,6 +82,9 @@ config :phoenix, :filter_parameters, [
 # Use Jason for JSON parsing in Phoenix
 config :phoenix, :json_library, Jason
 
+# Configure Req HTTP client to use our Finch pool with CA certs
+config :req, default_options: [finch: Towerops.Finch]
+
 # Configure tailwind (the version is required)
 config :tailwind,
   version: "4.1.12",
diff --git a/lib/towerops/application.ex b/lib/towerops/application.ex
index be0b5dda..2fe91169 100644
--- a/lib/towerops/application.ex
+++ b/lib/towerops/application.ex
@@ -91,6 +91,19 @@ defmodule Towerops.Application do
         {Cluster.Supervisor, [topologies, [name: Towerops.ClusterSupervisor]]},
         ToweropsWeb.Telemetry,
         Towerops.Repo,
+        # HTTP client pool with CA certificate configuration
+        # Ensures HTTPS works in containers where OS CA store is unavailable
+        {Finch,
+         name: Towerops.Finch,
+         pools: %{
+           default: [
+             conn_opts: [
+               transport_opts: [
+                 cacertfile: CAStore.file_path()
+               ]
+             ]
+           ]
+         }},
         # Encryption vault for sensitive data (passwords, API tokens)
         Towerops.Vault,
         # Error notifications via email (production only, gracefully shuts down in dev/test)