diff --git a/Dockerfile b/Dockerfile
index 78e5ca4..a054482 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,6 +10,7 @@ ARG LATEST_VERSION
 ARG ALL_JDK_STAGE=all-jdk-amd64
 ARG FULL_STAGE=full-amd64
 FROM eclipse-temurin:${LATEST_VERSION}-jdk-noble AS temurin-latest
+FROM registry.ddbuild.io/images/datadog-ca-certs:standard AS datadog-ca-certs
 
 # Intermediate image used to prune cruft from JDKs and squash them all.
 FROM ubuntu:24.04 AS all-jdk-common
@@ -53,6 +54,14 @@ RUN <<-EOT
 	sudo rm -rf /var/lib/apt/lists/*
 EOT
 
+# Stage the Datadog CA certs and import script, and trust the certs at the OS level.
+COPY --from=datadog-ca-certs /certs/datadog /usr/local/share/ca-certificates/datadog
+COPY scripts/import-datadog-certs.sh /usr/local/bin/import-datadog-certs.sh
+RUN <<-EOT
+	set -eux
+	sudo update-ca-certificates
+EOT
+
 ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en' LC_ALL='en_US.UTF-8'
 
 COPY --from=eclipse-temurin:8-jdk-noble /opt/java/openjdk /usr/lib/jvm/8
@@ -95,6 +104,9 @@ RUN --mount=type=secret,id=oracle_java8_token,uid=1001,gid=1001,mode=0400 <<-EOT
 	unset ORACLE_JAVA8_TOKEN
 EOT
 
+# Import the Datadog CA certs into every JDK's own cacerts truststore.
+RUN sudo /usr/local/bin/import-datadog-certs.sh /usr/lib/jvm
+
 # Remove cruft from JDKs that is not used in the build process.
 RUN <<-EOT
 	sudo rm -rf \
@@ -112,6 +124,9 @@ FROM all-jdk-common AS all-jdk-amd64
 COPY --from=zulu7-amd64 /usr/lib/jvm/zulu7 /usr/lib/jvm/7
 COPY --from=ibm8-amd64 /opt/ibm/java /usr/lib/jvm/ibm8
 
+# Import the Datadog CA certs into the amd64-only ibm8 truststore.
+RUN sudo /usr/local/bin/import-datadog-certs.sh /usr/lib/jvm/ibm8
+
 RUN <<-EOT
 	sudo rm -rf \
 		/usr/lib/jvm/*/lib/src.zip \
diff --git a/scripts/import-datadog-certs.sh b/scripts/import-datadog-certs.sh
new file mode 100755
index 0000000..8deb0a9
--- /dev/null
+++ b/scripts/import-datadog-certs.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+# Import the Datadog CA certificates into the truststore of every JDK
+# found under the given search roots (passed as arguments).
+set -eux
+
+DD_CERTS_DIR=/usr/local/share/ca-certificates/datadog
+
+# Truststore path pattern compatible with both legacy (JDK 8) and modern JDKs.
+JDK_TRUSTSTORE_PATH='*/lib/security/cacerts'
+
+for truststore in $(find -L "$@" -path "${JDK_TRUSTSTORE_PATH}" -type f | sort); do
+	java_home="${truststore%/lib/security/cacerts}"
+	java_home="${java_home%/jre}"
+	keytool="${java_home}/bin/keytool"
+	[ -x "${keytool}" ] || continue
+	for cert in $(find "${DD_CERTS_DIR}" -type f -name '*.crt' | sort); do
+		alias="datadog-$(basename "${cert}" .crt)"
+		if "${keytool}" -list -storepass changeit -keystore "${truststore}" -alias "${alias}" >/dev/null 2>&1; then
+			"${keytool}" -delete -storepass changeit -keystore "${truststore}" -alias "${alias}"
+		fi
+		"${keytool}" -importcert -noprompt -trustcacerts -storepass changeit -keystore "${truststore}" -alias "${alias}" -file "${cert}"
+	done
+done