diff --git a/src/Config.zig b/src/Config.zig
index 2f334cad0..59c20a0f8 100644
--- a/src/Config.zig
+++ b/src/Config.zig
@@ -94,6 +94,13 @@ const Cert = struct {
     // Number of certificate sources loaded into `store`.
     count: usize = 0,
 
+    fn deinit(self: *Cert) void {
+        if (self.store) |store| {
+            crypto.X509_STORE_free(store);
+        }
+        self.* = .{};
+    }
+
     /// Returns the store, creating it on first use. The store is shared by
     /// every `--ca-cert`/`--ca-path` occurrence.
     fn getOrCreate(self: *Cert) !*crypto.X509_STORE {
@@ -105,13 +112,6 @@ const Cert = struct {
         self.store = store;
         return store;
     }
-
-    fn deinit(self: *Cert) void {
-        if (self.store) |store| {
-            crypto.X509_STORE_free(store);
-        }
-        self.* = .{};
-    }
 };
 
 fn caCertValidator(
@@ -748,6 +748,20 @@ pub fn storageSqlitePath(self: *const Config) ?[:0]const u8 {
     };
 }
 
+/// Returns the user-supplied certificate store (`--ca-cert`/`--ca-path`),
+/// if any was loaded during argument parsing. The caller takes ownership.
+pub fn customCertStore(self: *const Config) ?*crypto.X509_STORE {
+    return switch (self.mode) {
+        inline .serve, .fetch, .mcp, .agent => |opts| {
+            const store = opts.cert.store orelse return null;
+            // Validators guarantee a created store loaded something.
+            lp.assert(opts.cert.count > 0, "empty custom cert store", .{});
+            return store;
+        },
+        else => null,
+    };
+}
+
 pub const DumpFormat = enum {
     html,
     markdown,