diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 6876e9e73588..e5b39cdd9dce 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -794,6 +794,7 @@ rec {
 
   # This provides the ca bundle in common locations
   caCertificates = runCommand "ca-certificates" { } ''
+    mkdir -p $out/etc/ssl/certs $out/etc/pki/tls/certs
     # Old NixOS compatibility.
     ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs/ca-bundle.crt
     # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index ff3934941c7b..224ba07b7743 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -698,4 +698,22 @@ rec {
     tag = "latest";
     contents = [ pkgs.bashInteractive ./test-dummy ];
   };
+
+  # ensure that caCertificates builds
+  image-with-certs = buildImage {
+    name = "curl";
+    tag = "latest";
+
+    copyToRoot = pkgs.buildEnv {
+      name = "image-with-certs-root";
+      paths = [
+        pkgs.curl
+        pkgs.dockerTools.caCertificates
+      ];
+    };
+
+    config = {
+      Entrypoint = [ "/bin/curl" ];
+    };
+  };
 }