diff --git a/modules/security/ca.nix b/modules/security/ca.nix
index 0ac4f565bd6..456f91b81e2 100644
--- a/modules/security/ca.nix
+++ b/modules/security/ca.nix
@@ -19,6 +19,9 @@ with pkgs.lib;
 
     environment.shellInit =
       ''
+        export OPENSSL_X509_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+
+        # !!! Remove the following as soon as OpenSSL 1.0.0e is the default.
         export CURL_CA_BUNDLE=/etc/ssl/certs/ca-bundle.crt
         export GIT_SSL_CAINFO=/etc/ssl/certs/ca-bundle.crt
       '';