diff --git a/edition/min b/edition/min
index e96750c..3b156a9 100644
--- a/edition/min
+++ b/edition/min
@@ -1,3 +1,4 @@
+export LIMA_INSTALL_CA_CERTIFICATES=false
 export LIMA_INSTALL_CLOUD_INIT=false
 export LIMA_INSTALL_LIMA_INIT=false
 export LIMA_INSTALL_BINFMT_MISC=false
diff --git a/edition/std b/edition/std
index 5ef551b..72bcd4f 100644
--- a/edition/std
+++ b/edition/std
@@ -1,4 +1,5 @@
 source edition/min
 LIMA_INSTALL_LIMA_INIT=true
 LIMA_INSTALL_BINFMT_MISC=true
+LIMA_INSTALL_CA_CERTIFICATES=true
 LIMA_INSTALL_SSHFS=true
diff --git a/genapkovl-lima.sh b/genapkovl-lima.sh
index 9cc598b..f26778c 100755
--- a/genapkovl-lima.sh
+++ b/genapkovl-lima.sh
@@ -113,11 +113,6 @@ network: { config: disabled }
 EOF
 fi
 
-if [ "${LIMA_INSTALL_K3S}" == "true" ]; then
-    echo "k3s" >> "$tmp"/etc/apk/world
-    rc_add k3s default
-fi
-
 if [ "${LIMA_INSTALL_BINFMT_MISC}" == "true" ]; then
     echo "qemu-aarch64" >> "$tmp"/etc/apk/world
 
@@ -131,6 +126,15 @@ if [ "${LIMA_INSTALL_BINFMT_MISC}" == "true" ]; then
     rc_add qemu-binfmt default
 fi
 
+if [ "${LIMA_INSTALL_CA_CERTIFICATES}" == "true" ]; then
+    echo "ca-certificates" >> "$tmp"/etc/apk/world
+fi
+
+if [ "${LIMA_INSTALL_K3S}" == "true" ]; then
+    echo "k3s" >> "$tmp"/etc/apk/world
+    rc_add k3s default
+fi
+
 if [ "${LIMA_INSTALL_SSHFS}" == "true" ]; then
     echo "sshfs" >> "$tmp"/etc/apk/world
 fi
diff --git a/mkimg.lima.sh b/mkimg.lima.sh
index ce6ef30..d6abdc5 100755
--- a/mkimg.lima.sh
+++ b/mkimg.lima.sh
@@ -14,6 +14,9 @@ profile_lima() {
 	syslinux_serial="0 115200"
 	apkovl="genapkovl-lima.sh"
 	apks="$apks openssh"
+        if [ "${LIMA_INSTALL_CA_CERTIFICATES}" == "true" ]; then
+            apks="$apks ca-certificates"
+        fi
         if [ "${LIMA_INSTALL_CLOUD_INIT}" == "true" ]; then
             apks="$apks cloud-init"
         fi