diff --git a/services/pelican.nix b/services/pelican.nix
index 9aff93a..aa516c2 100644
--- a/services/pelican.nix
+++ b/services/pelican.nix
@@ -101,7 +101,14 @@
         "/var/lib/pelican/:/var/lib/pelican/"
         "/var/log/pelican/:/var/log/pelican/"
         "/tmp/pelican/:/tmp/pelican/"
-        "/etc/ssl/certs:/etc/ssl/certs:ro"
+        # Upstream's compose mounts the whole /etc/ssl/certs directory, which
+        # is useless on NixOS: every entry there is a symlink through
+        # /etc/static into /nix/store, so the container inherits dangling
+        # links and wings dies with "x509: certificate signed by unknown
+        # authority" when it calls the panel. Bind the single file instead —
+        # docker resolves the symlink host-side, so the container gets real
+        # PEM content. This is the path Go checks first on Linux.
+        "/etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro"
       ];
       ports = [
         # Daemon API + console websocket — nginx fronts it as games.nordhammer.it.