diff --git a/pkgs/by-name/go/google-cloud-sdk/package.nix b/pkgs/by-name/go/google-cloud-sdk/package.nix
index e9fae78d0826..8c2f1e1aa696 100644
--- a/pkgs/by-name/go/google-cloud-sdk/package.nix
+++ b/pkgs/by-name/go/google-cloud-sdk/package.nix
@@ -8,6 +8,7 @@
 #
 
 {
+  cacert,
   stdenv,
   lib,
   fetchurl,
@@ -168,6 +169,16 @@ stdenv.mkDerivation rec {
     $out/bin/gsutil version | grep -w "$(cat platform/gsutil/VERSION)"
   '';
 
+  # Replace all vendored copies of CA bundle with the one used by Nixpkgs.
+  # This search/replace is a bit overzealous and replaces some files used by tests
+  # but it should cause no harm since we're not running those tests.
+  postFixup = ''
+    while IFS= read -rd "" f; do
+      echo "rewriting certificate bundle: $f"
+      ln -sf ${cacert}/etc/ssl/certs/ca-bundle.crt "$f"
+    done < <(find "$out" '(' -name cacert.pem -o -name cacerts.txt ')' -print0)
+  '';
+
   passthru = {
     inherit components withExtraComponents;
     updateScript = ./update.sh;