diff --git a/monitoring/mtls-bridge/app.py b/monitoring/mtls-bridge/app.py
index bc96265..6edc592 100644
--- a/monitoring/mtls-bridge/app.py
+++ b/monitoring/mtls-bridge/app.py
@@ -18,7 +18,7 @@ logging.getLogger("werkzeug").setLevel(logging.WARNING)
 TARGET_URL = os.environ.get("TARGET_URL")
 CLIENT_CERT = os.environ.get("CLIENT_CERT", "/certs/client.crt")
 CLIENT_KEY = os.environ.get("CLIENT_KEY", "/certs/client.key")
-CA_CERT = os.environ.get("CA_CERT", "/certs/ca.crt")
+UPSTREAM_CA_CERT = os.environ.get("UPSTREAM_CA_CERT", os.environ.get("CA_CERT", "")).strip()
 TIMEOUT = int(os.environ.get("TIMEOUT", "5"))
 
 logger.info(
@@ -32,6 +32,38 @@ logger.info(
 )
 
 
+def get_verify_setting():
+    if not UPSTREAM_CA_CERT:
+        return True
+
+    lowered = UPSTREAM_CA_CERT.lower()
+    if lowered in {"false", "0", "no"}:
+        logger.warning("TLS verification for upstream is disabled via UPSTREAM_CA_CERT=%s", UPSTREAM_CA_CERT)
+        return False
+
+    if not os.path.exists(UPSTREAM_CA_CERT):
+        logger.warning(
+            "Configured UPSTREAM_CA_CERT path does not exist: %s (falling back to system CA bundle)",
+            UPSTREAM_CA_CERT,
+        )
+        return True
+
+    return UPSTREAM_CA_CERT
+
+
+VERIFY_SETTING = get_verify_setting()
+
+logger.info(
+    "mtls-bridge starting target_url=%s timeout=%ss cert=%s key=%s verify=%s log_level=%s",
+    TARGET_URL,
+    TIMEOUT,
+    CLIENT_CERT,
+    CLIENT_KEY,
+    VERIFY_SETTING,
+    os.environ.get("LOG_LEVEL", "INFO"),
+)
+
+
 @app.route("/health", methods=["GET"])
 def health():
     logger.debug("healthcheck request from %s", request.remote_addr)
@@ -90,7 +122,7 @@ def proxy(path):
             data=request.get_data(cache=True),
             cookies=request.cookies,
             cert=(CLIENT_CERT, CLIENT_KEY),
-            verify=CA_CERT,
+            verify=VERIFY_SETTING,
             timeout=TIMEOUT,
         )
 
diff --git a/monitoring/mtls-bridge/docker-compose.yml b/monitoring/mtls-bridge/docker-compose.yml
index c640d0b..2034e32 100644
--- a/monitoring/mtls-bridge/docker-compose.yml
+++ b/monitoring/mtls-bridge/docker-compose.yml
@@ -9,9 +9,9 @@ services:
       - TARGET_URL=https://node-red.lan.ddnsgeek.com/docker-update-lockouts/clear
       - CLIENT_CERT=/certs/clients/office-pc/office-pc.crt
       - CLIENT_KEY=/certs/clients/office-pc/office-pc.key
-      - CA_CERT=/certs/ca/clients-ca.crt
       - TIMEOUT=5
       - LOG_LEVEL=${MTLS_BRIDGE_LOG_LEVEL:-INFO}
+      - UPSTREAM_CA_CERT=${MTLS_BRIDGE_UPSTREAM_CA_CERT:-}
     volumes:
       - ${PROJECT_ROOT}/core/traefik/certs:/certs:ro
     healthcheck: