diff --git a/pkg/config/init.go b/pkg/config/init.go
index 2efa7aef..b946a7ef 100644
--- a/pkg/config/init.go
+++ b/pkg/config/init.go
@@ -40,6 +40,9 @@ type ConsulConfig struct {
 	Username string `mapstructure:"username"`
 	Password string `mapstructure:"password"`
 	Token    string `mapstructure:"token"`
+	// CACert is the path to the CA certificate used to verify the Consul
+	// server certificate when connecting over HTTPS (production only).
+	CACert string `mapstructure:"ca_cert"`
 }
 
 type NATsConfig struct {
diff --git a/pkg/infra/consul.go b/pkg/infra/consul.go
index f25f77ea..fdf5565c 100644
--- a/pkg/infra/consul.go
+++ b/pkg/infra/consul.go
@@ -28,6 +28,13 @@ func GetConsulClient(environment string) *api.Client {
 				Password: password,
 			}
 		}
+
+		// Trust a custom CA for the Consul HTTPS endpoint. When unset, the
+		// client falls back to CONSUL_CACERT/CONSUL_CAPATH env vars and then
+		// the system trust store.
+		if caCert := viper.GetString("consul.ca_cert"); caCert != "" {
+			config.TLSConfig.CAFile = caCert
+		}
 	}
 
 	config.Address = viper.GetString("consul.address")
@@ -44,6 +51,7 @@ func GetConsulClient(environment string) *api.Client {
 		"wait_time", config.WaitTime,
 		"token_length", tokenLength,
 		"http_auth", config.HttpAuth,
+		"ca_cert", config.TLSConfig.CAFile,
 	)
 
 	// Ping the Consul server to verify connectivity