diff --git a/ntfy/ntfy-deployment.yaml b/ntfy/ntfy-deployment.yaml
index b055155..93752c0 100644
--- a/ntfy/ntfy-deployment.yaml
+++ b/ntfy/ntfy-deployment.yaml
@@ -60,7 +60,15 @@ spec:
           volumeMounts:
             - name: data
               mountPath: /var/lib/ntfy
+            # Trust store without the compromised eMudhra intermediates,
+            # see ca-bundle/. Drop once the image ships a fixed bundle.
+            - name: patched-ca-bundle
+              mountPath: /etc/ssl/certs
+              readOnly: true
       volumes:
         - name: data
           persistentVolumeClaim:
             claimName: ntfy-data
+        - name: patched-ca-bundle
+          configMap:
+            name: patched-ca-bundle