diff --git a/extra-manifests/registry-ca-configmap.yaml b/extra-manifests/registry-ca-configmap.yaml
new file mode 100644
index 0000000..642fddb
--- /dev/null
+++ b/extra-manifests/registry-ca-configmap.yaml
@@ -0,0 +1,67 @@
+# The registry CA's PUBLIC certificate, for Docker clients that push to
+# Harbor from inside the cluster.
+#
+# Not a secret, which is why it is committed here in plain sight rather than
+# going through Vault: it is the same certificate every node already fetches
+# from Secret Manager, and publishing a CA's public half is what a CA is for.
+# The private key is a different matter entirely — it exists only in
+# Terraform state and reaches the cluster as the `registry-ca` Secret in the
+# cert-manager namespace, which cert-manager uses to sign.
+#
+# Why this exists at all: the node pool trusting the CA covers image PULLS,
+# performed by containerd on the node. A `docker push` from a build pod is a
+# separate client with its own trust store, and it has no idea the node
+# trusts anything. Without this, pushes fail TLS verification while pulls of
+# the very same image work — which reads like a broken registry rather than a
+# missing trust anchor.
+#
+# Mount it in whichever container runs dockerd, at
+#   /etc/docker/certs.d/harbor.35.238.248.203.nip.io/ca.crt
+# The directory name must be the registry hostname exactly; dockerd looks the
+# path up by host, so a mismatch silently does nothing. Consumers so far: the
+# base-images mirror pod (devops-base-images-gcp) and devops-lib-gcp's build
+# pod template.
+#
+# The homelab needs none of this — its Harbor is plain HTTP and its dind
+# passes --insecure-registry instead.
+#
+# If the CA is ever regenerated in Terraform, this file must be updated to
+# match, along with the cert-manager Secret and the node pool's Secret
+# Manager version.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: registry-ca
+  namespace: jenkins
+data:
+  ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFMTCCAxmgAwIBAgIRAPf5gf3756sdf3nlZBTnlREwDQYJKoZIhvcNAQELBQAw
+    MjERMA8GA1UEChMIdG9vbHNoZWQxHTAbBgNVBAMTFHRvb2xzaGVkLXJlZ2lzdHJ5
+    LWNhMB4XDTI2MDkxMTA0MDIxNloXDTM2MDkwODA0MDIxNlowMjERMA8GA1UEChMI
+    dG9vbHNoZWQxHTAbBgNVBAMTFHRvb2xzaGVkLXJlZ2lzdHJ5LWNhMIICIjANBgkq
+    hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5GS3vpS2iG+Gl9YQx/NwlIXfMLhKVfDM
+    YixjPzYQv93Md9iR8c7CDFPijw8kf7200L7Z6Cp4hrCseL7QZZyvGnrmAt8lfhmz
+    Fj1Q9RP/WbKam2GHXanz3sWQ7XtUQiEg0yHkBchglgHQYQhdbePMi3zXPx8KPhis
+    QcNtOAAsLdisIaCz+NrA8qgPMel9LcdZTejaxhBRkOGPHO47xDslNl2JBnermbLc
+    XqWMh1exyWcscylaE8/e8brufRGWAXMfA+JElDH92VLIGaTQwI2KcTFr9SM7UwYN
+    tdcggT3BzPOmV/DaICJu+81RplZiEj+rU6ZQ1rwYUMPcEelWaDjL5e+27z5bFTJk
+    JCGc2x4HjfwD65961d0Mn/BqG8VzwS4lck9QvHcMNlw8o7AKr/q0ZWCcslMFZq7E
+    fmv6lZLl2Jw0go6dsh2kCRRGjoG4CoQ5YelRYgjzmNPDp4cN8rwKy/Oy80OGjvXt
+    +AgZvpjuBYGEEvSIM3QttU+6OOuHKxseAY5sbWzuhru0xASq3P4e2pQk8EacnTJc
+    OrMMDXd39vTazhEb1INJzOeD0fiBNTscQD/vbO0vffrNQiTF6NaKZErRhadZWDCq
+    3w5SslAEuHMF3op8KhrCggWG3HlQiHyt0GTKagz8DAKum8/ZMyuoIwp1UIrgp/q7
+    fZeqdSDqS5UCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFEjYpg0hI2j/UC88pR/aG1oeY4VnMA0GCSqGSIb3DQEBCwUA
+    A4ICAQDNIXgdYnKyDjI95dYSiqsdc4Je7hdFA62/9HXYkjtlsycmm3GM33DcX94N
+    9siAtnir6Br3yzGKdwQ8ZB5iZw6aIZTfgwgcnJA/Zrhsx0nfIyIlgZQHOalHXvXt
+    keE2XoMzF8vzN3YsMpEHT7gRrRQ7Rvn+wufgql5oiO0iaf6XYLypoyXKrBsg+gLh
+    8Ek29TuWry9Ip04wtfNCff0+o/vrSpsDVIA34ayEpDqKQqjEgxA8EF3MfXaA3aYb
+    JWcz+BR2eX3xACkkjCNMuVJFPdsdJyDPmWe8hESpdDY0ATBgyOiZtlcpK+3Uo/WN
+    AZX856Axi4vJjkNe8ve8+B3oCCbBVZHaPjoi9jEWt/FmO1mtM1On2SWKgHGM4olz
+    9nQUL6G+4qypWOCzgu1xtCGIOP184oWR6TMplEHafBUWfamRmNsMxzzWCujGCtFh
+    O43WajhM2fo2T3egtpCX3orzuOVIisT2trP8pgClB5IKqvoCKc7cyKEb8Va1MVur
+    pqu+4wNmvZ+M7xRAJhd7FljkeOUTGb3ziuVd8YHsx/GTmJV9QXN1CZsVaRJCZdTt
+    DcHPaQDiwfSdr+p6ILpyGPH0l+2A+NXSjDI/tCK9CIzeleCPy4m1UhffSqKOaEKs
+    Gn1E5oROiqzjN5SWKHJRShbxKMq+v3VBN0OZJxQAMshK9aC+eg==
+    -----END CERTIFICATE-----