diff --git a/pkgs/build-support/dotnet/nuget-to-nix/default.nix b/pkgs/build-support/dotnet/nuget-to-nix/default.nix
index c443e2ba6242..73f3995bb91d 100644
--- a/pkgs/build-support/dotnet/nuget-to-nix/default.nix
+++ b/pkgs/build-support/dotnet/nuget-to-nix/default.nix
@@ -9,12 +9,13 @@
 , curl
 , gnugrep
 , gawk
+, cacert
 }:
 
 runCommandLocal "nuget-to-nix" {
   script = substituteAll {
     src = ./nuget-to-nix.sh;
-    inherit runtimeShell;
+    inherit runtimeShell cacert;
 
     binPath = lib.makeBinPath [
       nix
diff --git a/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh b/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
index aae56c8ddfb1..712f3e1a744c 100755
--- a/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
+++ b/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
@@ -3,6 +3,7 @@
 set -euo pipefail
 shopt -s nullglob
 
+export SSL_CERT_FILE=@cacert@/etc/ssl/certs/ca-bundle.crt
 export PATH="@binPath@:$PATH"
 # used for glob ordering of package names
 export LC_ALL=C