{
  config,
  inputs,
  system,
  lib,
  ...
}:
let
  selfPkgs = inputs.self.packages.${system};
in
{
  security.pki.certificateFiles = lib.lists.optionals config.sas.build.private [
    "${selfPkgs.sas-cacert}/etc/ssl/certs/ca-bundle.crt"
  ];
}