diff --git a/.vscode/tasks.json b/.vscode/tasks.json
index 49b915c..8d6e399 100644
--- a/.vscode/tasks.json
+++ b/.vscode/tasks.json
@@ -45,6 +45,18 @@
         }
       ]
     },
+    {
+      "label": "ansible: setup PKI",
+      "type": "shell",
+      "command": "${workspaceFolder}/scripts/deploy.py",
+      "args": [
+        "--host",
+        "${input:targetHost}",
+        "--tags",
+        "pki"
+      ],
+      "problemMatcher": []
+    },
     {
       "label": "ansible: deploy gitlab to host",
       "type": "shell",
diff --git a/ansible/playbooks/gitlab_setup.yml b/ansible/playbooks/gitlab_setup.yml
index 3bade71..e8d6f16 100644
--- a/ansible/playbooks/gitlab_setup.yml
+++ b/ansible/playbooks/gitlab_setup.yml
@@ -3,6 +3,10 @@
   hosts: all
   become: false
 
+  vars:
+    gitlab_external_host: >-
+      {{ ansible_facts['fqdn'] | default(ansible_facts['hostname'], true) }}
+
   pre_tasks:
     - name: Show deployment target
       ansible.builtin.debug:
@@ -10,6 +14,8 @@
       tags: [always]
 
   roles:
+    - role: pki
+      tags: [pki, service]
     - role: gitlab_service
       tags: [service]
     - role: gitlab_runner
diff --git a/ansible/roles/gitlab_runner/defaults/main.yml b/ansible/roles/gitlab_runner/defaults/main.yml
index 6c2b928..0558248 100644
--- a/ansible/roles/gitlab_runner/defaults/main.yml
+++ b/ansible/roles/gitlab_runner/defaults/main.yml
@@ -11,12 +11,16 @@ gitlab_runner_job_image: "localhost/gitlab-runner-image:latest"
 gitlab_runner_job_image_pull_policy:
   - if-not-present
 gitlab_runner_job_network: host
-gitlab_runner_gitlab_url: "http://jupiter:8081"
+gitlab_runner_gitlab_url: "https://{{ gitlab_external_host }}:8081"
 gitlab_runner_token: ""
 gitlab_runner_name: "{{ ansible_facts['fqdn'] | default(ansible_facts['hostname'], true) }}"
 gitlab_runner_service_name: gitlab-runner
 gitlab_runner_config_dir: "/var/lib/gitlab-runner/config"
 gitlab_runner_builds_dir: "/var/lib/gitlab-runner/builds"
+gitlab_runner_ca_dir: "{{ gitlab_runner_config_dir }}/certs"
+gitlab_runner_ca_certificate: "{{ gitlab_runner_ca_dir }}/root-ca.crt"
+gitlab_runner_ca_container_certificate: /etc/gitlab-runner/certs/root-ca.crt
+gitlab_runner_job_ca_certificate: "{{ gitlab_runner_ca_container_certificate }}"
 gitlab_runner_podman_socket: >-
   unix:///run/user/{{ gitlab_runner_user_uid }}/podman/podman.sock
 gitlab_runner_images:
diff --git a/ansible/roles/gitlab_runner/tasks/build_and_ship_image.yml b/ansible/roles/gitlab_runner/tasks/build_and_ship_image.yml
index 8d24338..8187f65 100644
--- a/ansible/roles/gitlab_runner/tasks/build_and_ship_image.yml
+++ b/ansible/roles/gitlab_runner/tasks/build_and_ship_image.yml
@@ -9,14 +9,13 @@
   become: false
 
 - name: Build image locally
-  containers.podman.podman_image:
-    name: "{{ container_image_name }}"
-    tag: latest
-    path: "{{ container_image_context }}"
-    state: present
-    build:
-      file: "{{ container_image_containerfile }}"
-      extra_args: "{{ container_image_build_extra_args }}"
+  ansible.builtin.command:
+    cmd: >-
+      podman build --tag {{ container_image_name | quote }}
+      --file {{ container_image_containerfile | quote }}
+      {{ container_image_build_extra_args }}
+      {{ container_image_context | quote }}
+  changed_when: true
   delegate_to: localhost
   become: false
 
diff --git a/ansible/roles/gitlab_runner/tasks/register.yml b/ansible/roles/gitlab_runner/tasks/register.yml
index cb40121..a5b97be 100644
--- a/ansible/roles/gitlab_runner/tasks/register.yml
+++ b/ansible/roles/gitlab_runner/tasks/register.yml
@@ -8,6 +8,24 @@
     mode: "0700"
   become: true
 
+- name: Create GitLab Runner CA certificate directory
+  ansible.builtin.file:
+    path: "{{ gitlab_runner_ca_dir }}"
+    state: directory
+    owner: "{{ gitlab_runner_user }}"
+    group: "{{ gitlab_runner_user }}"
+    mode: "0755"
+  become: true
+
+- name: Deploy PKI root CA for GitLab Runner
+  ansible.builtin.copy:
+    src: "{{ pki_root_ca_certificate }}"
+    dest: "{{ gitlab_runner_ca_certificate }}"
+    owner: "{{ gitlab_runner_user }}"
+    group: "{{ gitlab_runner_user }}"
+    mode: "0644"
+  become: true
+
 - name: Create GitLab Runner builds directory
   ansible.builtin.file:
     path: "{{ gitlab_runner_builds_dir }}"
@@ -49,6 +67,8 @@
       - --non-interactive
       - --url
       - "{{ gitlab_runner_gitlab_url }}"
+      - --tls-ca-file
+      - "{{ gitlab_runner_ca_container_certificate }}"
       - --token
       - "{{ gitlab_runner_token }}"
       - --name
@@ -63,8 +83,12 @@
       - "{{ gitlab_runner_job_image }}"
       - --docker-pull-policy
       - "{{ gitlab_runner_job_image_pull_policy | first }}"
-      - --docker-network
+      - --docker-network-mode
       - "{{ gitlab_runner_job_network }}"
+      - --docker-volumes
+      - "{{ gitlab_runner_ca_certificate }}:{{ gitlab_runner_job_ca_certificate }}:ro"
+      - --env
+      - "GIT_SSL_CAINFO={{ gitlab_runner_job_ca_certificate }}"
       - --docker-privileged
   changed_when: true
   become: true
@@ -72,6 +96,35 @@
   no_log: true
   when: not gitlab_runner_config.stat.exists
 
+- name: Configure GitLab Runner TLS connection
+  ansible.builtin.lineinfile:
+    path: "{{ gitlab_runner_config_dir }}/config.toml"
+    regexp: "^\\s*{{ item.key }}\\s*="
+    line: "  {{ item.key }} = \"{{ item.value }}\""
+    insertafter: '^\[\[runners\]\]$'
+    owner: "{{ gitlab_runner_user }}"
+    group: "{{ gitlab_runner_user }}"
+    mode: "0600"
+  become: true
+  notify: Restart GitLab Runner service
+  loop:
+    - key: url
+      value: "{{ gitlab_runner_gitlab_url }}"
+    - key: tls-ca-file
+      value: "{{ gitlab_runner_ca_container_certificate }}"
+
+- name: Configure GitLab Runner job CA trust
+  ansible.builtin.lineinfile:
+    path: "{{ gitlab_runner_config_dir }}/config.toml"
+    regexp: "^\\s*environment\\s*="
+    line: '  environment = ["GIT_SSL_CAINFO={{ gitlab_runner_job_ca_certificate }}"]'
+    insertafter: '^\[\[runners\]\]$'
+    owner: "{{ gitlab_runner_user }}"
+    group: "{{ gitlab_runner_user }}"
+    mode: "0600"
+  become: true
+  notify: Restart GitLab Runner service
+
 - name: Configure GitLab Runner Docker executor
   ansible.builtin.lineinfile:
     path: "{{ gitlab_runner_config_dir }}/config.toml"
@@ -88,3 +141,5 @@
       value: "{{ gitlab_runner_job_image_pull_policy | to_json }}"
     - key: network_mode
       value: '"{{ gitlab_runner_job_network }}"'
+    - key: volumes
+      value: '["/cache", "{{ gitlab_runner_ca_certificate }}:{{ gitlab_runner_job_ca_certificate }}:ro"]'
diff --git a/ansible/roles/gitlab_runner/tasks/service.yml b/ansible/roles/gitlab_runner/tasks/service.yml
index c54d54f..a6451b3 100644
--- a/ansible/roles/gitlab_runner/tasks/service.yml
+++ b/ansible/roles/gitlab_runner/tasks/service.yml
@@ -10,7 +10,6 @@
     state: started
     enabled: true
 
-
 - name: Ensure Quadlet directory exists
   become: true
   become_user: "{{ gitlab_runner_user }}"
@@ -41,6 +40,6 @@
   ansible.builtin.systemd:
     name: "{{ gitlab_runner_service_name }}.service"
     scope: user
-    state: started
+    state: restarted
     enabled: true
 ...
diff --git a/ansible/roles/gitlab_service/defaults/main.yml b/ansible/roles/gitlab_service/defaults/main.yml
index 65cd372..197e4d3 100644
--- a/ansible/roles/gitlab_service/defaults/main.yml
+++ b/ansible/roles/gitlab_service/defaults/main.yml
@@ -4,11 +4,17 @@ gitlab_service_name: gitlab
 gitlab_service_net: gitlabnet
 # Uses the fully qualified hostname reported by the managed host. Override in
 # inventory when GitLab is published under a different external DNS name.
-gitlab_service_external_host: "{{ ansible_facts['fqdn'] | default(ansible_facts['hostname'], true) }}"
+gitlab_service_external_host: "{{ gitlab_external_host }}"
 gitlab_service_volume_recreate: false
 gitlab_service_config_dir: /var/lib/gitlab/config
 gitlab_service_logs_dir: /var/lib/gitlab/logs
 gitlab_service_data_dir: /var/lib/gitlab/data
+gitlab_service_tls_dir: "{{ gitlab_service_config_dir }}/ssl"
+gitlab_service_tls_certificate: "{{ gitlab_service_tls_dir }}/gitlab.crt"
+gitlab_service_tls_private_key: "{{ gitlab_service_tls_dir }}/gitlab.key"
+gitlab_service_tls_container_dir: /etc/gitlab/ssl
+gitlab_service_tls_container_certificate: "{{ gitlab_service_tls_container_dir }}/gitlab.crt"
+gitlab_service_tls_container_private_key: "{{ gitlab_service_tls_container_dir }}/gitlab.key"
 
 gitlab_service_web_port: 8081
 gitlab_service_ssh_port: 2223
diff --git a/ansible/roles/gitlab_service/tasks/volume.yml b/ansible/roles/gitlab_service/tasks/volume.yml
index 6493387..528135a 100644
--- a/ansible/roles/gitlab_service/tasks/volume.yml
+++ b/ansible/roles/gitlab_service/tasks/volume.yml
@@ -37,14 +37,32 @@
     - "{{ gitlab_service_logs_dir }}"
     - "{{ gitlab_service_data_dir }}"
 
-# The OpenSSH daemon bundled in the image isn't exposed as a Chef attribute
-- name: Create OpenSSH "down" marker file
+- name: Create GitLab TLS directory
   become: true
   ansible.builtin.file:
-    path: "{{ gitlab_service_config_dir }}/sshd-down"
-    state: touch
+    path: "{{ gitlab_service_tls_dir }}"
+    state: directory
+    owner: "{{ gitlab_service_user }}"
+    group: "{{ gitlab_service_user }}"
+    mode: "0700"
+
+- name: Deploy GitLab TLS private key
+  become: true
+  ansible.builtin.copy:
+    src: "{{ pki_gitlab_private_key }}"
+    dest: "{{ gitlab_service_tls_private_key }}"
+    owner: "{{ gitlab_service_user }}"
+    group: "{{ gitlab_service_user }}"
+    mode: "0600"
+  no_log: true
+
+- name: Deploy GitLab TLS certificate chain
+  become: true
+  ansible.builtin.copy:
+    content: |-
+      {{ lookup('ansible.builtin.file', pki_gitlab_certificate) }}
+      {{ lookup('ansible.builtin.file', pki_intermediate_ca_certificate) }}
+    dest: "{{ gitlab_service_tls_certificate }}"
     owner: "{{ gitlab_service_user }}"
     group: "{{ gitlab_service_user }}"
-    mode: "0640"
-    modification_time: preserve
-    access_time: preserve
+    mode: "0644"
diff --git a/ansible/roles/gitlab_service/templates/gitlab.rb.j2 b/ansible/roles/gitlab_service/templates/gitlab.rb.j2
index ee66d64..59684b2 100644
--- a/ansible/roles/gitlab_service/templates/gitlab.rb.j2
+++ b/ansible/roles/gitlab_service/templates/gitlab.rb.j2
@@ -2,7 +2,11 @@
 ## To change settings, edit the template and re-run the deploy playbook;
 ## GitLab picks this up on its next `gitlab-ctl reconfigure` (container restart).
 
-external_url 'http://{{ gitlab_service_external_host }}:{{ gitlab_service_web_port }}/'
+external_url 'https://{{ gitlab_service_external_host }}:{{ gitlab_service_web_port }}/'
+gitlab_rails['nginx']['ssl_certificate'] = '{{ gitlab_service_tls_container_certificate }}'
+gitlab_rails['nginx']['ssl_certificate_key'] = '{{ gitlab_service_tls_container_private_key }}'
+# We supply our own PKI-issued cert/key, so don't let Chef manage the SSL dir.
+letsencrypt['enable'] = false
 
 gitlab_rails['env'] = {
   'GITLAB_LOG_LEVEL' => '{{ gitlab_service_log_level }}'
@@ -23,9 +27,11 @@ logging['logrotate_compress'] = 'compress'
 
 # Container registry settings
 {% if gitlab_service_registry_enabled | bool %}
-registry_external_url 'http://{{ gitlab_service_external_host }}:{{ gitlab_service_registry_port }}'
+registry_external_url 'https://{{ gitlab_service_external_host }}:{{ gitlab_service_registry_port }}'
 gitlab_rails['registry_enabled'] = true
 registry['enable'] = true
+registry['nginx']['ssl_certificate'] = '{{ gitlab_service_tls_container_certificate }}'
+registry['nginx']['ssl_certificate_key'] = '{{ gitlab_service_tls_container_private_key }}'
 {% else %}
 gitlab_rails['registry_enabled'] = false
 registry['enable'] = false
diff --git a/ansible/roles/pki/defaults/main.yml b/ansible/roles/pki/defaults/main.yml
new file mode 100644
index 0000000..91737ab
--- /dev/null
+++ b/ansible/roles/pki/defaults/main.yml
@@ -0,0 +1,28 @@
+pki_root_ca_common_name: "embtom Infrastructure Root CA"
+
+pki_country: "DE"
+pki_state: "Bayern"
+pki_organization: "embtom"
+
+pki_controller_root_dir: >-
+  {{ lookup('ansible.builtin.env', 'HOME') }}/.local/share/gitlab-infra/pki
+pki_root_ca_key: "{{ pki_controller_root_dir }}/private/root-ca.key"
+pki_root_ca_csr: "{{ pki_controller_root_dir }}/csr/root-ca.csr"
+pki_root_ca_certificate: "{{ pki_controller_root_dir }}/certs/root-ca.crt"
+
+pki_intermediate_ca_common_name: "embtom GitLab Issuing CA"
+pki_intermediate_ca_dir: "{{ pki_controller_root_dir }}/intermediate"
+pki_intermediate_ca_key: "{{ pki_intermediate_ca_dir }}/private/intermediate-ca.key"
+pki_intermediate_ca_csr: "{{ pki_intermediate_ca_dir }}/csr/intermediate-ca.csr"
+pki_intermediate_ca_certificate: >-
+  {{ pki_intermediate_ca_dir }}/certs/intermediate-ca.crt
+
+pki_gitlab_common_name: "{{ gitlab_external_host }}"
+pki_gitlab_certificate_name: >-
+  {{ gitlab_external_host | regex_replace('[^A-Za-z0-9._-]', '_') }}-server
+pki_gitlab_private_key: >-
+  {{ pki_intermediate_ca_dir }}/private/{{ pki_gitlab_certificate_name }}.key
+pki_gitlab_csr: >-
+  {{ pki_intermediate_ca_dir }}/csr/{{ pki_gitlab_certificate_name }}.csr
+pki_gitlab_certificate: >-
+  {{ pki_intermediate_ca_dir }}/certs/{{ pki_gitlab_certificate_name }}.crt
diff --git a/ansible/roles/pki/tasks/gitlab-certificate.yml b/ansible/roles/pki/tasks/gitlab-certificate.yml
new file mode 100644
index 0000000..b1e51bd
--- /dev/null
+++ b/ansible/roles/pki/tasks/gitlab-certificate.yml
@@ -0,0 +1,36 @@
+---
+- name: Create GitLab TLS private key
+  community.crypto.openssl_privatekey:
+    path: "{{ pki_gitlab_private_key }}"
+    type: RSA
+    size: 4096
+    mode: "0600"
+  delegate_to: localhost
+  become: false
+
+- name: Create GitLab TLS CSR
+  community.crypto.openssl_csr:
+    path: "{{ pki_gitlab_csr }}"
+    privatekey_path: "{{ pki_gitlab_private_key }}"
+    common_name: "{{ pki_gitlab_common_name }}"
+    subject_alt_name:
+      - "DNS:{{ pki_gitlab_common_name }}"
+    key_usage:
+      - digitalSignature
+      - keyEncipherment
+    extended_key_usage:
+      - serverAuth
+  delegate_to: localhost
+  become: false
+
+- name: Sign GitLab TLS certificate with intermediate CA
+  community.crypto.x509_certificate:
+    path: "{{ pki_gitlab_certificate }}"
+    csr_path: "{{ pki_gitlab_csr }}"
+    provider: ownca
+    ownca_path: "{{ pki_intermediate_ca_certificate }}"
+    ownca_privatekey_path: "{{ pki_intermediate_ca_key }}"
+    ownca_not_after: "+365d"
+    ownca_digest: sha256
+  delegate_to: localhost
+  become: false
diff --git a/ansible/roles/pki/tasks/intermediate-ca.yml b/ansible/roles/pki/tasks/intermediate-ca.yml
new file mode 100644
index 0000000..ffa0d3c
--- /dev/null
+++ b/ansible/roles/pki/tasks/intermediate-ca.yml
@@ -0,0 +1,68 @@
+---
+- name: Create controller intermediate CA directory
+  ansible.builtin.file:
+    path: "{{ pki_intermediate_ca_dir }}"
+    state: directory
+    mode: "0700"
+  delegate_to: localhost
+  become: false
+  run_once: true
+
+- name: Create controller intermediate CA subdirectories
+  ansible.builtin.file:
+    path: "{{ pki_intermediate_ca_dir }}/{{ item.name }}"
+    state: directory
+    mode: "{{ item.mode }}"
+  loop:
+    - name: private
+      mode: "0700"
+    - name: csr
+      mode: "0755"
+    - name: certs
+      mode: "0755"
+  delegate_to: localhost
+  become: false
+  run_once: true
+
+- name: Create intermediate CA private key
+  community.crypto.openssl_privatekey:
+    path: "{{ pki_intermediate_ca_key }}"
+    type: RSA
+    size: 4096
+    mode: "0600"
+  delegate_to: localhost
+  become: false
+  run_once: true
+
+- name: Create intermediate CA CSR
+  community.crypto.openssl_csr:
+    path: "{{ pki_intermediate_ca_csr }}"
+    privatekey_path: "{{ pki_intermediate_ca_key }}"
+    common_name: "{{ pki_intermediate_ca_common_name }}"
+    country_name: "{{ pki_country }}"
+    state_or_province_name: "{{ pki_state }}"
+    organization_name: "{{ pki_organization }}"
+    basic_constraints:
+      - "CA:TRUE"
+      - "pathlen:0"
+    basic_constraints_critical: true
+    key_usage:
+      - keyCertSign
+      - cRLSign
+    key_usage_critical: true
+  delegate_to: localhost
+  become: false
+  run_once: true
+
+- name: Sign intermediate CA certificate with root CA
+  community.crypto.x509_certificate:
+    path: "{{ pki_intermediate_ca_certificate }}"
+    csr_path: "{{ pki_intermediate_ca_csr }}"
+    provider: ownca
+    ownca_path: "{{ pki_root_ca_certificate }}"
+    ownca_privatekey_path: "{{ pki_root_ca_key }}"
+    ownca_not_after: "+1825d"
+    ownca_digest: sha256
+  delegate_to: localhost
+  become: false
+  run_once: true
diff --git a/ansible/roles/pki/tasks/main.yml b/ansible/roles/pki/tasks/main.yml
new file mode 100644
index 0000000..df33122
--- /dev/null
+++ b/ansible/roles/pki/tasks/main.yml
@@ -0,0 +1,16 @@
+---
+- name: Debug Message
+  ansible.builtin.debug:
+    msg: "Start installation of PKI"
+
+- name: Create root CA
+  ansible.builtin.include_tasks: root-ca.yml
+
+- name: Create intermediate CA
+  ansible.builtin.include_tasks: intermediate-ca.yml
+
+- name: Create GitLab TLS certificate
+  ansible.builtin.include_tasks: gitlab-certificate.yml
+
+- name: Verify PKI certificate chain
+  ansible.builtin.include_tasks: verify_chain.yml
diff --git a/ansible/roles/pki/tasks/root-ca.yml b/ansible/roles/pki/tasks/root-ca.yml
new file mode 100644
index 0000000..66d1d41
--- /dev/null
+++ b/ansible/roles/pki/tasks/root-ca.yml
@@ -0,0 +1,69 @@
+---
+- name: Create controller PKI root directory
+  ansible.builtin.file:
+    path: "{{ pki_controller_root_dir }}"
+    state: directory
+    mode: "0700"
+  delegate_to: localhost
+  become: false
+  run_once: true
+
+- name: Create controller PKI subdirectories
+  ansible.builtin.file:
+    path: "{{ pki_controller_root_dir }}/{{ item.name }}"
+    state: directory
+    mode: "{{ item.mode }}"
+  loop:
+    - name: private
+      mode: "0700"
+    - name: csr
+      mode: "0755"
+    - name: certs
+      mode: "0755"
+  delegate_to: localhost
+  become: false
+  run_once: true
+
+- name: Create root CA private key
+  community.crypto.openssl_privatekey:
+    path: "{{ pki_root_ca_key }}"
+    type: RSA
+    size: 4096
+    mode: "0600"
+  delegate_to: localhost
+  become: false
+  run_once: true
+
+- name: Create root CA CSR
+  community.crypto.openssl_csr:
+    path: "{{ pki_root_ca_csr }}"
+    privatekey_path: "{{ pki_root_ca_key }}"
+    common_name: "{{ pki_root_ca_common_name }}"
+    country_name: "{{ pki_country }}"
+    state_or_province_name: "{{ pki_state }}"
+    organization_name: "{{ pki_organization }}"
+    basic_constraints:
+      - "CA:TRUE"
+      # Permit one intermediate CA while preventing deeper CA chains.
+      - "pathlen:1"
+    basic_constraints_critical: true
+    key_usage:
+      - digitalSignature
+      - keyCertSign
+      - cRLSign
+    key_usage_critical: true
+  delegate_to: localhost
+  become: false
+  run_once: true
+
+- name: Create self-signed root CA certificate
+  community.crypto.x509_certificate:
+    path: "{{ pki_root_ca_certificate }}"
+    csr_path: "{{ pki_root_ca_csr }}"
+    privatekey_path: "{{ pki_root_ca_key }}"
+    provider: selfsigned
+    selfsigned_not_after: "+3650d"
+    selfsigned_digest: sha256
+  delegate_to: localhost
+  become: false
+  run_once: true
diff --git a/ansible/roles/pki/tasks/verify_chain.yml b/ansible/roles/pki/tasks/verify_chain.yml
new file mode 100644
index 0000000..0dd03bb
--- /dev/null
+++ b/ansible/roles/pki/tasks/verify_chain.yml
@@ -0,0 +1,45 @@
+---
+- name: Verify intermediate CA against root CA
+  ansible.builtin.command:
+    argv:
+      - openssl
+      - verify
+      - -CAfile
+      - "{{ pki_root_ca_certificate }}"
+      - "{{ pki_intermediate_ca_certificate }}"
+  register: pki_intermediate_verify
+  changed_when: false
+  delegate_to: localhost
+  become: false
+
+- name: Verify server certificate against root and intermediate CA
+  ansible.builtin.command:
+    argv:
+      - openssl
+      - verify
+      - -CAfile
+      - "{{ pki_root_ca_certificate }}"
+      - -untrusted
+      - "{{ pki_intermediate_ca_certificate }}"
+      - "{{ pki_gitlab_certificate }}"
+  register: pki_server_verify
+  changed_when: false
+  delegate_to: localhost
+  become: false
+
+- name: Show PKI verification result
+  ansible.builtin.debug:
+    msg:
+      - "Intermediate: {{ pki_intermediate_verify.stdout }}"
+      - "Server: {{ pki_server_verify.stdout }}"
+
+- name: Assert PKI certificate chain is valid
+  ansible.builtin.assert:
+    that:
+      - pki_intermediate_verify.rc == 0
+      - pki_server_verify.rc == 0
+    fail_msg: >-
+      PKI verification failed.
+      Intermediate: {{ pki_intermediate_verify.stderr | default('') }}
+      Server: {{ pki_server_verify.stderr | default('') }}
+    success_msg: "PKI certificate chain is valid."
diff --git a/containers/gitlab-runner-image/Containerfile.runner b/containers/gitlab-runner-image/Containerfile.runner
index 56e8d7a..fab52b1 100644
--- a/containers/gitlab-runner-image/Containerfile.runner
+++ b/containers/gitlab-runner-image/Containerfile.runner
@@ -75,6 +75,8 @@ RUN python3 -m pip install --upgrade --no-cache-dir --user \
 # Add containers config
 COPY config/containers.conf /etc/containers/containers.conf
 COPY config/storage.conf /etc/containers/storage.conf
+COPY scripts/install-root-ca.sh /usr/local/bin/install-root-ca
+RUN chmod 0755 /usr/local/bin/install-root-ca
 
 # Prepare container storage structure
 RUN mkdir -p /usr/lib/containers/storage/overlay-images \
@@ -110,4 +112,5 @@ RUN set -eux; \
 
 RUN echo "Build is using version: ${VERSION}"
 
+ENTRYPOINT ["/usr/local/bin/install-root-ca"]
 CMD ["/bin/bash"]
diff --git a/containers/gitlab-runner-image/scripts/install-root-ca.sh b/containers/gitlab-runner-image/scripts/install-root-ca.sh
new file mode 100644
index 0000000..6913463
--- /dev/null
+++ b/containers/gitlab-runner-image/scripts/install-root-ca.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+set -eu
+
+ca_source=/etc/gitlab-runner/certs/root-ca.crt
+ca_destination=/usr/local/share/ca-certificates/gitlab-infra-root-ca.crt
+
+if [ -f "$ca_source" ]; then
+  cp "$ca_source" "$ca_destination"
+  update-ca-certificates
+fi
+
+exec "$@"
diff --git a/requirements.yml b/requirements.yml
index 479a353..34a6f86 100644
--- a/requirements.yml
+++ b/requirements.yml
@@ -3,3 +3,4 @@ collections:
   - name: containers.podman
   - name: community.general
   - name: ansible.posix
+  - name: community.crypto
diff --git a/scripts/deploy.py b/scripts/deploy.py
index 29b4695..65904c3 100755
--- a/scripts/deploy.py
+++ b/scripts/deploy.py
@@ -133,6 +133,8 @@ def resolve_tags(args: argparse.Namespace) -> list[str]:
 
 
 def build_command(tags: list[str], limit: str, vars_file: Path) -> list[str]:
+    requires_become = set(tags) != {"pki"}
+
     command = [
         "ansible-playbook",
         "--inventory",
@@ -140,7 +142,7 @@ def build_command(tags: list[str], limit: str, vars_file: Path) -> list[str]:
         "playbooks/gitlab_setup.yml",
         *(
             []
-            if os.environ.get("GITLAB_INFRA_BECOME_PASSWORD")
+            if not requires_become or os.environ.get("GITLAB_INFRA_BECOME_PASSWORD")
             else ["--ask-become-pass"]
         ),
         "--limit",