@@ -1,5 +1,7 @@
 ---
 "trigger.dev": patch
+"@trigger.dev/core": patch
+"@trigger.dev/build": patch
 ---
 
-Fix `extraCACerts` in `trigger.config.ts` having no effect on deployed tasks. The CA file is now included in the deployed image and `NODE_EXTRA_CA_CERTS` points at it, so self-signed or corporate certificates are trusted at runtime.
+Fix `extraCACerts` in `trigger.config.ts` having no effect on deployed tasks. The CA file is now included in the deployed image and `NODE_EXTRA_CA_CERTS` points at it, so self-signed or corporate certificates are trusted at runtime, including with `--local-bundle` and `--from-bundle`. Also fixes files outside the project directory (such as `../shared/ca.crt`) being copied to the wrong place on Windows.
@@ -1,5 +1,5 @@
 import { cp, copyFile, mkdir } from "node:fs/promises";
-import { dirname, join, posix, relative } from "node:path";
+import { dirname, join, relative, sep } from "node:path";
 import { glob } from "tinyglobby";
 
 /**
@@ -44,9 +44,9 @@ export async function findFilesByMatchers(
 
     const assets: CopyPair[] = files.map((file) => {
       const pathInsideDestinationDir = relative(cwd, file)
-        .split(posix.sep)
+        .split(sep)
         .filter((p) => p !== "..")
-        .join(posix.sep);
+        .join(sep);
       return {
         source: file,
         destination: join(destinationDir, pathInsideDestinationDir),
 
@@ -4,6 +4,7 @@ import { BuildManifest, BuildTarget, TaskFile } from "@trigger.dev/core/v3/schem
 import * as esbuild from "esbuild";
 import { createHash } from "node:crypto";
 import { basename, join, relative, resolve } from "node:path";
+import { resolveExtraCACertsImagePath } from "../deploy/buildImage.js";
 import { createFile, createFileWithStore } from "../utilities/fileSystem.js";
 import { logger } from "../utilities/logger.js";
 import { resolveFileSources } from "../utilities/sourceFiles.js";
@@ -404,6 +405,10 @@ export async function createBuildManifestFromBundle({
     config: {
       project: resolvedConfig.project,
       dirs: resolvedConfig.dirs,
+      extraCACerts: resolveExtraCACertsImagePath(
+        resolvedConfig.extraCACerts,
+        resolvedConfig.workingDir
+      ),
     },
     outputPath: destination,
     indexControllerEntryPoint:
 
@@ -50,7 +50,7 @@ import {
 } from "../cli/common.js";
 import { loadConfig } from "../config.js";
 import { authenticateForDeploy, userIdForDeploy } from "../deploy/auth.js";
-import { buildImage, resolveExtraCACertsImagePath } from "../deploy/buildImage.js";
+import { buildImage } from "../deploy/buildImage.js";
 import {
   checkLogsForErrors,
   checkLogsForWarnings,
@@ -765,10 +765,7 @@ async function _deployCommand(dir: string, options: DeployCommandOptions) {
     externalBuildProjectId: deployment.externalBuildData?.projectId,
     projectId: projectClient.id,
     projectRef: resolvedConfig.project,
-    extraCACerts: resolveExtraCACertsImagePath(
-      resolvedConfig.extraCACerts,
-      resolvedConfig.workingDir
-    ),
+    extraCACerts: buildManifest.config.extraCACerts,
     apiUrl: projectClient.client.apiURL,
     apiKey: projectClient.client.accessToken!,
     apiClient: projectClient.client,
@@ -1670,11 +1667,17 @@ async function handleLocalBundleDeploy({
   const bundleOutputPath = destination.path;
 
   // Extensions can set undefined values at runtime despite the manifest type
-  const bundleBuildEnvVars = Object.fromEntries(
-    Object.entries(buildManifest.build.env ?? {}).filter(
-      (entry): entry is [string, string] => typeof entry[1] === "string"
-    )
-  );
+  const bundleBuildEnvVars: Record<string, string> = {
+    ...Object.fromEntries(
+      Object.entries(buildManifest.build.env ?? {}).filter(
+        (entry): entry is [string, string] => typeof entry[1] === "string"
+      )
+    ),
+    // The Containerfile reads NODE_EXTRA_CA_CERTS as a build arg, which the build server passes through
+    ...(buildManifest.config.extraCACerts
+      ? { NODE_EXTRA_CA_CERTS: buildManifest.config.extraCACerts }
+      : {}),
+  };
 
   if (options.dryRun) {
     logger.info(`Dry run complete. View the built bundle at ${destination.path}`);
@@ -1911,6 +1914,7 @@ async function buildAndFinalizeFromBundle({
   authAccessToken,
   compilationPath,
   buildEnvVars,
+  extraCACerts,
   branch,
   isLocalBuild,
 }: {
@@ -1923,6 +1927,7 @@ async function buildAndFinalizeFromBundle({
   authAccessToken: string;
   compilationPath: string;
   buildEnvVars: Record<string, string | undefined> | undefined;
+  extraCACerts: string | undefined;
   branch: string | undefined;
   isLocalBuild: boolean;
 }) {
@@ -1975,6 +1980,7 @@ async function buildAndFinalizeFromBundle({
     externalBuildProjectId: deployment.externalBuildData?.projectId,
     projectId,
     projectRef,
+    extraCACerts,
     apiUrl: apiClient.apiURL,
     apiKey: apiClient.accessToken!,
     apiClient,
@@ -2343,6 +2349,7 @@ async function handleFromBundleDeploy({
     authAccessToken: auth.accessToken,
     compilationPath: bundlePath,
     buildEnvVars,
+    extraCACerts: bundleManifest.config.extraCACerts,
     branch,
     isLocalBuild: true,
   });
 
@@ -1,5 +1,5 @@
 import { readFileSync } from "node:fs";
-import { join } from "node:path";
+import path, { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import type { BuildRuntime } from "@trigger.dev/core/v3/schemas";
 import { describe, expect, it } from "vitest";
@@ -66,6 +66,15 @@ describe("resolveExtraCACertsImagePath", () => {
   it("strips leading parent segments the same way additionalFiles does", () => {
     expect(resolveExtraCACertsImagePath("../shared/ca.crt", "/project")).toBe("/app/shared/ca.crt");
   });
+
+  it("handles Windows separators", () => {
+    expect(resolveExtraCACertsImagePath("../shared/ca.crt", "C:\\project", path.win32)).toBe(
+      "/app/shared/ca.crt"
+    );
+    expect(resolveExtraCACertsImagePath("./certs/ca.crt", "C:\\project", path.win32)).toBe(
+      "/app/certs/ca.crt"
+    );
+  });
 });
 
 describe("generateContainerfile", () => {
 
@@ -3,7 +3,7 @@ import { depot } from "@depot/cli";
 import { x } from "tinyexec";
 import type { BuildManifest, BuildRuntime } from "@trigger.dev/core/v3/schemas";
 import { networkInterfaces } from "os";
-import { join, relative, resolve, sep } from "path";
+import path, { join } from "path";
 import { safeReadJSONFile } from "../utilities/fileSystem.js";
 import { readFileSync } from "fs";
 
@@ -59,13 +59,18 @@ export interface BuildImageOptions {
  * Where the CA file ends up inside the image. The build copies it into /app using the same layout
  * as additionalFiles (path relative to the project root, with leading `..` segments stripped).
  */
-export function resolveExtraCACertsImagePath(extraCACerts: string | undefined, workingDir: string) {
+export function resolveExtraCACertsImagePath(
+  extraCACerts: string | undefined,
+  workingDir: string,
+  pathApi: Pick<typeof path, "relative" | "resolve" | "sep"> = path
+) {
   if (!extraCACerts) {
     return undefined;
   }
 
-  const relativePath = relative(workingDir, resolve(workingDir, extraCACerts))
-    .split(sep)
+  const relativePath = pathApi
+    .relative(workingDir, pathApi.resolve(workingDir, extraCACerts))
+    .split(pathApi.sep)
     .filter((segment) => segment !== "..")
     .join("/");
 
 
@@ -3,6 +3,8 @@ import { z } from "zod/v4";
 export const ConfigManifest = z.object({
   project: z.string(),
   dirs: z.string().array(),
+  /** Path of the extra CA file inside the image, used for NODE_EXTRA_CA_CERTS */
+  extraCACerts: z.string().optional(),
 });
 
 export type ConfigManifest = z.infer<typeof ConfigManifest>;