diff --git a/.gitea/workflows/build-and-publish.yaml b/.gitea/workflows/build-and-publish.yaml
index 914df52..77e8b9b 100644
--- a/.gitea/workflows/build-and-publish.yaml
+++ b/.gitea/workflows/build-and-publish.yaml
@@ -82,13 +82,18 @@ jobs:
           test -d /usr/share/hyperdeck
           test -f /etc/hyperdeck/config.json
           test -f /usr/lib/systemd/system/hyperdeck.service
-          python3 -m py_compile /usr/share/hyperdeck/main.py
-          echo "eendoe-hyperdeck: OK"
+      - name: Test install bnhmeijer-ca-certificates
+        run: |
+          echo "=== Installing bnhmeijer-ca-certificates ==="
+          sudo apt-get install -y ./staging/bnhmeijer-ca-certificates-*.deb
+          dpkg -s bnhmeijer-ca-certificates | grep -q "Status: install ok installed"
+          test -f /usr/local/share/ca-certificates/bnhmeijer/bnhmeijer-root-ca.crt
+          echo "bnhmeijer-ca-certificates: OK"
 
       - name: Test package uninstall and cleanup
         run: |
           echo "=== Testing package removal ==="
-          sudo apt-get remove -y eendoe-hyperdeck eendoe-srs eendoe-repository
+          sudo apt-get remove -y eendoe-hyperdeck eendoe-srs eendoe-repository bnhmeijer-ca-certificates
           echo "Package removal: OK"
 
   publish:
diff --git a/README.md b/README.md
index bb921aa..6d97920 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,7 @@ Debian / APT package repository bronbestanden en build tools voor Eendoe.
 
 - **`sources/`**: Bronbestanden, control definities en packaging scripts voor de te bouwen packages:
   - `eendoe_repository`: Repository configuratie package (`/etc/apt/sources.list.d/`)
+  - `bnhmeijer_ca_certificates`: Bnhmeijer Homelab Root CA package voor `/usr/local/share/ca-certificates/`
   - `eendoe_hyperdeck`: Hyperdeck Python service en systemd unit
   - `eendoe_srs`: SRS streaming server package en systemd unit
 - **`staging/`**: Bestaande en nieuw gebouwde `.deb` packages (exclusief Oracle database packages).
diff --git a/binaries/index.html b/binaries/index.html
index d12d50c..2d85664 100644
--- a/binaries/index.html
+++ b/binaries/index.html
@@ -645,6 +645,17 @@
                     </div>
                 </div>
 
+                <div class="pkg-card">
+                    <div>
+                        <div class="pkg-name">bnhmeijer-ca-certificates</div>
+                        <div class="pkg-desc">Bnhmeijer Homelab Root CA certificaat. Voegt de root CA automatisch toe aan de OS trust store zodat interne TLS-certificaten direct vertrouwd worden.</div>
+                    </div>
+                    <div class="pkg-footer">
+                        <span>Versie: 1.0.0</span>
+                        <span>Arch: all</span>
+                    </div>
+                </div>
+
                 <div class="pkg-card">
                     <div>
                         <div class="pkg-name">eendoe-repository</div>
diff --git a/binaries/pool/main/b/bnhmeijer-ca-certificates/bnhmeijer-ca-certificates-1.0.0_all.deb b/binaries/pool/main/b/bnhmeijer-ca-certificates/bnhmeijer-ca-certificates-1.0.0_all.deb
new file mode 100644
index 0000000..3cf5f71
Binary files /dev/null and b/binaries/pool/main/b/bnhmeijer-ca-certificates/bnhmeijer-ca-certificates-1.0.0_all.deb differ
diff --git a/sources/bnhmeijer_ca_certificates/bin/build.sh b/sources/bnhmeijer_ca_certificates/bin/build.sh
new file mode 100755
index 0000000..bd1874a
--- /dev/null
+++ b/sources/bnhmeijer_ca_certificates/bin/build.sh
@@ -0,0 +1,45 @@
+#!/bin/sh
+set -e
+
+CONTROL_FILE=$(ls -1 *.control 2>/dev/null | head -n 1)
+
+if [ -z "$CONTROL_FILE" ]; then
+    echo "Fout: Geen .control bestand gevonden in $(pwd)" >&2
+    exit 1
+fi
+
+PACKAGE_NAME=$(awk '/^Package: /{print $NF}' "$CONTROL_FILE")
+DETECTED_VERSION=$(awk '/^Version: /{print $NF}' "$CONTROL_FILE")
+
+# Version resolution: CLI arg > ENV var > .control version > default 0.1.0
+if [ -n "$1" ]; then
+    VERSION="$1"
+elif [ -n "$PACKAGE_VERSION" ]; then
+    VERSION="$PACKAGE_VERSION"
+elif [ -n "$VERSION" ]; then
+    VERSION="$VERSION"
+elif [ "$DETECTED_VERSION" != "{VERSION}" ] && [ -n "$DETECTED_VERSION" ]; then
+    VERSION="$DETECTED_VERSION"
+else
+    VERSION="0.1.0"
+fi
+
+mkdir -p "packaging/$PACKAGE_NAME/DEBIAN"
+sed "s/{VERSION}/${VERSION}/" "$CONTROL_FILE" > "packaging/$PACKAGE_NAME/DEBIAN/control"
+
+ARCH=$(awk '/^Architecture: /{print $NF}' "packaging/$PACKAGE_NAME/DEBIAN/control")
+ARCH="${ARCH:-all}"
+DEB_FILENAME="${PACKAGE_NAME}-${VERSION}_${ARCH}.deb"
+
+echo "Building package: $PACKAGE_NAME ($VERSION) [$ARCH] -> $DEB_FILENAME"
+
+# Ensure correct Debian directory permissions
+find "packaging/$PACKAGE_NAME" -type d -exec chmod 755 {} +
+find "packaging/$PACKAGE_NAME/DEBIAN" -type f -exec chmod 755 {} + 2>/dev/null || true
+
+# Build debian binary package
+dpkg-deb --build "packaging/$PACKAGE_NAME" "$DEB_FILENAME"
+
+# Cleanup temporary control file
+rm -f "packaging/$PACKAGE_NAME/DEBIAN/control"
+echo "Succesvol gebouwd: $DEB_FILENAME"
diff --git a/sources/bnhmeijer_ca_certificates/bnhmeijer-ca-certificates.control b/sources/bnhmeijer_ca_certificates/bnhmeijer-ca-certificates.control
new file mode 100644
index 0000000..f864411
--- /dev/null
+++ b/sources/bnhmeijer_ca_certificates/bnhmeijer-ca-certificates.control
@@ -0,0 +1,12 @@
+Package: bnhmeijer-ca-certificates
+Version: 1.0.0
+Section: utils
+Priority: optional
+Architecture: all
+Depends: ca-certificates
+Maintainer: Bart Meijer <info@bnhmeijer.nl>
+Description: Bnhmeijer Homelab Root CA certificate
+ Installs the Bnhmeijer Homelab Root CA certificate into the system trust store
+ (/usr/local/share/ca-certificates/bnhmeijer/) and updates the CA trust list.
+ Ensures all homelab internal services (*.lan and *.bnhmeijer.nl) signed by
+ cert-service are automatically trusted by the OS and browsers.
diff --git a/sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/DEBIAN/postinst b/sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/DEBIAN/postinst
new file mode 100755
index 0000000..08d175e
--- /dev/null
+++ b/sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/DEBIAN/postinst
@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    configure|abort-upgrade)
+        if command -v update-ca-certificates >/dev/null 2>&1; then
+            echo "Updating system trusted CA certificates..."
+            update-ca-certificates >/dev/null 2>&1 || true
+        fi
+    ;;
+esac
+exit 0
diff --git a/sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/DEBIAN/postrm b/sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/DEBIAN/postrm
new file mode 100755
index 0000000..71dbbcd
--- /dev/null
+++ b/sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/DEBIAN/postrm
@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    remove|purge|disappear)
+        if command -v update-ca-certificates >/dev/null 2>&1; then
+            echo "Removing certificate from system trust store..."
+            update-ca-certificates --fresh >/dev/null 2>&1 || true
+        fi
+    ;;
+esac
+exit 0
diff --git a/sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/usr/local/share/ca-certificates/bnhmeijer/bnhmeijer-root-ca.crt b/sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/usr/local/share/ca-certificates/bnhmeijer/bnhmeijer-root-ca.crt
new file mode 100644
index 0000000..2556a3b
--- /dev/null
+++ b/sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/usr/local/share/ca-certificates/bnhmeijer/bnhmeijer-root-ca.crt
@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFZzCCA0+gAwIBAgIRALCvASaMQ9DZPQrGDIYTVkswDQYJKoZIhvcNAQELBQAw
+TTEiMCAGA1UEAwwZQm5obWVpamVyIEhvbWVsYWIgUm9vdCBDQTEaMBgGA1UECgwR
+Qm5obWVpamVyIEhvbWVsYWIxCzAJBgNVBAYTAk5MMB4XDTI2MTAyMDIwMjQ0OVoX
+DTM2MTAxNzIwMjQ0OVowTTEiMCAGA1UEAwwZQm5obWVpamVyIEhvbWVsYWIgUm9v
+dCBDQTEaMBgGA1UECgwRQm5obWVpamVyIEhvbWVsYWIxCzAJBgNVBAYTAk5MMIIC
+IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuOKEFT0p9uzcxf5hfPyvjFDd
+Fs2GxN3nUNJ+6fzdwR3Bf0yeFYLIHA8C/7hMApt5JGW/ndnYEA7hk0Oj2mbXUo7o
+j7zIKke5OALBO3SSvJSywwBOsaZ95sSTfkYvmCOLojH/EUmLA6+MmUtSTWMIm1do
+ki2H8BEdXzeE4XtI/Fw8v1kRX0AYA3l4+AB8ejVSHIuhcWgbrwGKkRZFBEAJMXEp
+IKkYiYPxAZ4AUy4FJHVJwpdK9JLc6ORQS4kpBWJRGROwSePs2hfMn3tSg3xfyOK/
+c8bOyGTx9O1tjWcfN2cPbGhJ5Uo9j5uyZnAvdkR0mniELB6/G6jM4UzKfmVvQEMt
+jH76vowFzJmDiKWRJgmq1rEEdSVPDowateLEac5YkGIc9e+/1G3yKQH+eqcHbGvQ
+ORnQF03rB5jNWUHdF5WSbMHPszOndMHnUYMrHC025ApIKXcO8R1/ld0DsMRGY4sS
+wQfRQW5oVOOxQkPMk2LcC4v9Gz/ox9DuAhBXpQUpoXkZ/Zdd2zI2eKLnKuYqkiUv
+UOUJAUapyztQCCWpxeU9gxTBOrN1g5sSVy3p5lrSWNMQUNXNyOr3ylj3XVQFZxtR
+WM64tHb8M4UpHYvLG7Bw7m59BgwgEJP686ShnQg/CpE0XpILU+GH8FPL2k8Zl9RB
+H3jJjLrGEjexiv0KdDcCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B
+Af8EBAMCAQYwHQYDVR0OBBYEFH1zTZdKh8Q63s5JV5UwrfHB6rAYMA0GCSqGSIb3
+DQEBCwUAA4ICAQBQmMk725RF2qzN5Me+MuY/N0GdJGNauZ9KvzSybyCIrXfycmid
+vwU+g1j3nFwVs2FSH3cU6s06jH1Lr0soz74cEmU/Zn94G3Yp8nMh3Nz+qwmJenD1
+ffF9bTgk2b/jhSRRNU4nDm0HvdfUGLTxgmtAkI45dAmmtynGhKhaFqyxbosxz/Pr
+Cqzo6SSrKYx7bHj8Wk2wdB6hDY5UbzOvBVWq8JqZCJiSLNjZNgD64YFUtbBTK3kD
+CLJhesuf6Qg8UBUL34NqIHfTC5J6G2AlFOLBi6DKBc7rnTlHCCesUUGZqxQy58nC
+MSlRLKRg3tqQq1Hy839Vb/llmpQDujWDaQ7ptN1bn2ATzdruc+PW2pPv6Ffs3lS7
+o+69mk5/NDhkqNCM1EYK2hDEkO1jdiyUgmXi0i7ni7Qea3HSK2WYAtHPTIDHAGCz
+O2Lvfbeq70rfGIf2FJRItIqmS8OjOggGp++ED2d49hvw3Tfxnw108SqYFph2QN/d
+rt8kvcXkMNGQXE7eIqyY5sgI3tJuYpy2r7BWsg0EFwYVphZ0o/SFZTleSTKSxGpr
+NLXKcqxyEYCmZfZLiWRcvTFOkzCqnLQZGJMMdk3Nkq6IwAaZiyRtW6QBHLaIHX/v
+UX0C3FD+bSuRfZbZGcTmdHVLKAdCOfMp0w/oW5X4vURcjoGJNbd8z0UU0A==
+-----END CERTIFICATE-----
diff --git a/sources/eendoe_hyperdeck/bin/build.sh b/sources/eendoe_hyperdeck/bin/build.sh
index 00ba7f6..bd1874a 100755
--- a/sources/eendoe_hyperdeck/bin/build.sh
+++ b/sources/eendoe_hyperdeck/bin/build.sh
@@ -33,6 +33,10 @@ DEB_FILENAME="${PACKAGE_NAME}-${VERSION}_${ARCH}.deb"
 
 echo "Building package: $PACKAGE_NAME ($VERSION) [$ARCH] -> $DEB_FILENAME"
 
+# Ensure correct Debian directory permissions
+find "packaging/$PACKAGE_NAME" -type d -exec chmod 755 {} +
+find "packaging/$PACKAGE_NAME/DEBIAN" -type f -exec chmod 755 {} + 2>/dev/null || true
+
 # Build debian binary package
 dpkg-deb --build "packaging/$PACKAGE_NAME" "$DEB_FILENAME"
 
diff --git a/sources/eendoe_repository/bin/build.sh b/sources/eendoe_repository/bin/build.sh
index 00ba7f6..bd1874a 100755
--- a/sources/eendoe_repository/bin/build.sh
+++ b/sources/eendoe_repository/bin/build.sh
@@ -33,6 +33,10 @@ DEB_FILENAME="${PACKAGE_NAME}-${VERSION}_${ARCH}.deb"
 
 echo "Building package: $PACKAGE_NAME ($VERSION) [$ARCH] -> $DEB_FILENAME"
 
+# Ensure correct Debian directory permissions
+find "packaging/$PACKAGE_NAME" -type d -exec chmod 755 {} +
+find "packaging/$PACKAGE_NAME/DEBIAN" -type f -exec chmod 755 {} + 2>/dev/null || true
+
 # Build debian binary package
 dpkg-deb --build "packaging/$PACKAGE_NAME" "$DEB_FILENAME"
 
diff --git a/sources/eendoe_srs/bin/build.sh b/sources/eendoe_srs/bin/build.sh
index 00ba7f6..bd1874a 100755
--- a/sources/eendoe_srs/bin/build.sh
+++ b/sources/eendoe_srs/bin/build.sh
@@ -33,6 +33,10 @@ DEB_FILENAME="${PACKAGE_NAME}-${VERSION}_${ARCH}.deb"
 
 echo "Building package: $PACKAGE_NAME ($VERSION) [$ARCH] -> $DEB_FILENAME"
 
+# Ensure correct Debian directory permissions
+find "packaging/$PACKAGE_NAME" -type d -exec chmod 755 {} +
+find "packaging/$PACKAGE_NAME/DEBIAN" -type f -exec chmod 755 {} + 2>/dev/null || true
+
 # Build debian binary package
 dpkg-deb --build "packaging/$PACKAGE_NAME" "$DEB_FILENAME"
 
diff --git a/staging/bnhmeijer-ca-certificates-1.0.0_all.deb b/staging/bnhmeijer-ca-certificates-1.0.0_all.deb
new file mode 100644
index 0000000..3cf5f71
Binary files /dev/null and b/staging/bnhmeijer-ca-certificates-1.0.0_all.deb differ