diff --git a/programs/GNUmakefile b/programs/GNUmakefile
index d6d75e6..2385380 100644
--- a/programs/GNUmakefile
+++ b/programs/GNUmakefile
@@ -76,7 +76,7 @@ WWWSRC := $(wildcard $(WWWDIR)/*.*)
 WWWDST := $(patsubst $(WWWDIR)/%,$(BINDIR)/www/%,$(WWWSRC))
 
 # CA certificate bundle.
-CA_CERTS := $(BINDIR)/etc/ca-certificates.crt
+CA_CERTS := $(BINDIR)/os/certs/ca-certificates.crt
 
 # System config TOML files bundled into bin/config/.
 CONFIGDIR := data/config
@@ -326,9 +326,9 @@ $(BINDIR)/www/%: $(WWWDIR)/%
 	mkdir -p $(BINDIR)/www
 	cp $< $@
 
-# Copy CA certificate bundle into bin/etc/.
+# Copy CA certificate bundle into bin/os/certs/.
 $(CA_CERTS): data/ca-certificates.crt
-	mkdir -p $(BINDIR)/etc
+	mkdir -p $(BINDIR)/os/certs
 	cp $< $@
 
 # Copy system config files into bin/config/.
diff --git a/programs/lib/tls/tls.cpp b/programs/lib/tls/tls.cpp
index 00917e9..b414913 100644
--- a/programs/lib/tls/tls.cpp
+++ b/programs/lib/tls/tls.cpp
@@ -109,7 +109,7 @@ namespace tls {
 
 TrustAnchors load_trust_anchors() {
     TrustAnchors tas = {nullptr, 0, 0};
-    int fh = montauk::open("0:/etc/ca-certificates.crt");
+    int fh = montauk::open("0:/os/certs/ca-certificates.crt");
     if (fh < 0) return tas;
     uint64_t fsize = montauk::getsize(fh);
     if (fsize == 0 || fsize > 512 * 1024) { montauk::close(fh); return tas; }
diff --git a/template/docs/syscalls.md b/template/docs/syscalls.md
index 3e7dcef..3cc7141 100644
--- a/template/docs/syscalls.md
+++ b/template/docs/syscalls.md
@@ -325,7 +325,7 @@ Provides a high-level `tls::https_fetch()` that handles socket creation, BearSSL
 ```cpp
 #include <tls/tls.hpp>
 
-// Load CA certificates (from 0:/etc/ca-certificates.crt)
+// Load CA certificates (from 0:/os/certs/ca-certificates.crt)
 tls::TrustAnchors tas = tls::load_trust_anchors();
 
 // Build HTTP request
@@ -349,7 +349,7 @@ if (n > 0) {
 
 ```cpp
 namespace tls {
-    // Load PEM CA bundle from 0:/etc/ca-certificates.crt
+    // Load PEM CA bundle from 0:/os/certs/ca-certificates.crt
     TrustAnchors load_trust_anchors();
 
     // High-level: DNS → socket → TLS → exchange → cleanup