diff --git a/install-caddy-local-ca.sh b/install-caddy-local-ca.sh
new file mode 100644
index 0000000..ea23e9e
--- /dev/null
+++ b/install-caddy-local-ca.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CERT_URL="${CERT_URL:-https://gitea.wheelytho.com/Wheelz/Docker-Install/raw/branch/main/caddy-local-root.crt}"
+CERT_NAME="${CERT_NAME:-wheelz-caddy-local-root.crt}"
+EXPECTED_SHA256="${EXPECTED_SHA256:-d4b15cd45c797fd329df47b634d0fc7e9f858e9506ed572c64d00332ea5cf388}"
+
+if [ "${EUID}" -ne 0 ]; then
+  echo "Run as root, e.g. curl -fsSL ... | sudo bash" >&2
+  exit 1
+fi
+
+if ! command -v curl >/dev/null 2>&1; then
+  apt-get update
+  apt-get install -y curl ca-certificates
+fi
+
+tmp="$(mktemp)"
+trap 'rm -f "$tmp"' EXIT
+curl -fsSL "$CERT_URL" -o "$tmp"
+actual="$(sha256sum "$tmp" | awk '{print $1}')"
+if [ "$actual" != "$EXPECTED_SHA256" ]; then
+  echo "CA certificate sha256 mismatch: got $actual expected $EXPECTED_SHA256" >&2
+  exit 1
+fi
+
+if command -v update-ca-certificates >/dev/null 2>&1; then
+  CERT_DIR="/usr/local/share/ca-certificates"
+  mkdir -p "$CERT_DIR"
+  install -m 0644 "$tmp" "${CERT_DIR}/${CERT_NAME}"
+  update-ca-certificates
+elif command -v trust >/dev/null 2>&1; then
+  trust anchor "$tmp"
+else
+  echo "Unsupported distro: no update-ca-certificates or trust command found." >&2
+  exit 1
+fi
+
+echo "Installed Wheelz Caddy local root CA."
+echo "Verified SHA256: ${EXPECTED_SHA256}"