diff --git a/gitops/workloads/gitlab-runner/gitlab-tls-secret.yaml b/gitops/workloads/gitlab-runner/gitlab-tls-secret.yaml
new file mode 100644
index 0000000..60f3930
--- /dev/null
+++ b/gitops/workloads/gitlab-runner/gitlab-tls-secret.yaml
@@ -0,0 +1,22 @@
+---
+# Lab CA certificate used by the gitlab-runner to verify GitLab's TLS cert.
+# The cert is signed by lab-ca (CA:TRUE) — public info, safe to store in git.
+#
+# To regenerate this file after a lab CA rotation:
+#   CA_B64=$(kubectl -n gitlab-runner get secret gitlab-lab-tls \
+#              -o jsonpath='{.data.ca\.crt}')
+#   # then replace the tls.crt value below with $CA_B64
+#
+# The file key must be named <hostname>.crt — the runner scans the mount dir
+# for files matching the hostname it's connecting to.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitlab-tls
+  namespace: gitlab-runner
+type: Opaque
+data:
+  # base64-encoded lab root CA certificate (PEM)
+  # Populated via: kubectl -n gitlab-runner get secret gitlab-lab-tls \
+  #                  -o jsonpath='{.data.ca\.crt}'
+  gitlab.lab.home.arpa.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJzVENDQVZlZ0F3SUJBZ0lSQU41M2JLc3NsalRLZFpsdlVMTFFZMkF3Q2dZSUtvWkl6ajBFQXdJd09ERVcKTUJRR0ExVUVDaE1OYkdGaUxtaHZiV1V1WVhKd1lURWVNQndHQTFVRUF4TVZUR0ZpSUVodmJXVWdRWEp3WVNCUwpiMjkwSUVOQk1CNFhEVEkyTURZeU5URTJNRE0wT1ZvWERUTTJNRFl5TWpFMk1ETTBPVm93T0RFV01CUUdBMVVFCkNoTU5iR0ZpTG1odmJXVXVZWEp3WVRFZU1Cd0dBMVVFQXhNVlRHRmlJRWh2YldVZ1FYSndZU0JTYjI5MElFTkIKTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFOGMyNWR1UVFMaFhOdXpBWUQvL2hkR1NXTExnYgpxMUd4SmdYRGdRVEJ6R2p2TlFCRTcrem1lZ3NBcDBGMXplS3h1b0tWbWs3UDBuSDZ3TjlzcFNVNVpxTkNNRUF3CkRnWURWUjBQQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkRVaFJWcVgKa05TUFYwcTM2NndzZ3hsd242WUZNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUUNuYWhubS9qRDhLRTIrTEp0UQpML056QWxmNE9ZeGdVQThMaTArS3pCUm9XZ0lnT0JsTHMySlFueHBsL3dDbUhDLytGU25zN01FTXVLSkJ1bk40ClhCbUVNOG89Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
diff --git a/gitops/workloads/gitlab-runner/kustomization.yaml b/gitops/workloads/gitlab-runner/kustomization.yaml
index 0c7e9f8..adbc0f6 100644
--- a/gitops/workloads/gitlab-runner/kustomization.yaml
+++ b/gitops/workloads/gitlab-runner/kustomization.yaml
@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - external-secret.yaml
   - gitlab-cert.yaml
+  - gitlab-tls-secret.yaml