diff --git a/kubernetes/apps/test-browser/deployment.yaml b/kubernetes/apps/test-browser/deployment.yaml
index 5aef5082..51585bd0 100644
--- a/kubernetes/apps/test-browser/deployment.yaml
+++ b/kubernetes/apps/test-browser/deployment.yaml
@@ -35,6 +35,34 @@ spec:
             - dash.renner.uno
             - audiobooks.renner.uno
             - ical-proxy.renner.uno
+      initContainers:
+        # Fetch the Let's Encrypt staging root CAs at pod start so
+        # Firefox trusts the staging-issued certs that every K8s
+        # ingress serves. Writes into a shared emptyDir volume
+        # that the firefox container mounts read-only.
+        - name: fetch-le-staging-roots
+          image: curlimages/curl:8.10.1
+          command:
+            - sh
+            - -c
+            - |
+              set -eu
+              curl -sfL -o /certs/letsencrypt-stg-root-x1.pem \
+                https://letsencrypt.org/certs/staging/letsencrypt-stg-root-x1.pem
+              curl -sfL -o /certs/letsencrypt-stg-root-x2.pem \
+                https://letsencrypt.org/certs/staging/letsencrypt-stg-root-x2.pem
+              chmod 0644 /certs/*.pem
+              echo "Fetched LE staging roots:"
+              ls -l /certs/
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1000
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: le-certs
+              mountPath: /certs
       containers:
         - name: firefox
           image: kasmweb/firefox:1.17.0-rolling-daily
@@ -62,8 +90,23 @@ spec:
           volumeMounts:
             - name: shm
               mountPath: /dev/shm
+            - name: firefox-policies
+              mountPath: /etc/firefox/policies/policies.json
+              subPath: policies.json
+              readOnly: true
+            - name: le-certs
+              mountPath: /etc/firefox/certs
+              readOnly: true
       volumes:
         - name: shm
           emptyDir:
             medium: Memory
             sizeLimit: 512Mi
+        - name: firefox-policies
+          configMap:
+            name: test-browser-firefox-policies
+            items:
+              - key: policies.json
+                path: policies.json
+        - name: le-certs
+          emptyDir: {}
diff --git a/kubernetes/apps/test-browser/firefox-policies.yaml b/kubernetes/apps/test-browser/firefox-policies.yaml
new file mode 100644
index 00000000..2ac4c326
--- /dev/null
+++ b/kubernetes/apps/test-browser/firefox-policies.yaml
@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-browser-firefox-policies
+  namespace: apps
+data:
+  # Firefox Enterprise Policy. Tells Firefox to trust the two
+  # Let's Encrypt staging roots that cert-manager's
+  # letsencrypt-staging ClusterIssuer chains from. Without this,
+  # every *.renner.uno hostname browsed inside the test-browser
+  # Firefox produces a SEC_ERROR_UNKNOWN_ISSUER warning.
+  #
+  # Docs: https://mozilla.github.io/policy-templates/#certificates
+  policies.json: |
+    {
+      "policies": {
+        "Certificates": {
+          "ImportEnterpriseRoots": true,
+          "Install": [
+            "/etc/firefox/certs/letsencrypt-stg-root-x1.pem",
+            "/etc/firefox/certs/letsencrypt-stg-root-x2.pem"
+          ]
+        }
+      }
+    }
diff --git a/kubernetes/apps/test-browser/kustomization.yaml b/kubernetes/apps/test-browser/kustomization.yaml
index 94bdff30..a0f21571 100644
--- a/kubernetes/apps/test-browser/kustomization.yaml
+++ b/kubernetes/apps/test-browser/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
   - deployment.yaml
   - service.yaml
   - ingress.yaml
+  - firefox-policies.yaml