cat << 'EOF' | git apply
diff --git a/internal/coss/secrets/azure/provider.go b/internal/coss/secrets/azure/provider.go
--- a/internal/coss/secrets/azure/provider.go
+++ b/internal/coss/secrets/azure/provider.go
@@ -8,6 +8,8 @@
 import (
 	"context"
 	"crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
 	"fmt"
 	"net/http"
 	"os"
@@ -55,12 +57,37 @@
 
 		// Use fake credential for emulator testing
 		cred = &fakeCredential{}
+
+		// Configure TLS to trust the emulator's CA certificate instead of disabling verification.
+		emulatorCACertPath := os.Getenv("AZURE_KEYVAULT_EMULATOR_CA_CERT")
+		if emulatorCACertPath == "" {
+			return nil, fmt.Errorf("AZURE_KEYVAULT_EMULATOR_CA_CERT must be set when using AZURE_KEYVAULT_EMULATOR")
+		}
+
+		caData, err := os.ReadFile(emulatorCACertPath)
+		if err != nil {
+			return nil, fmt.Errorf("reading emulator CA certificate from %s: %w", emulatorCACertPath, err)
+		}
+
+		block, _ := pem.Decode(caData)
+		if block == nil {
+			return nil, fmt.Errorf("failed to decode PEM for emulator CA certificate at %s", emulatorCACertPath)
+		}
+
+		cert, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("parsing emulator CA certificate at %s: %w", emulatorCACertPath, err)
+		}
+
+		caPool := x509.NewCertPool()
+		caPool.AddCert(cert)
+
 		clientOpts = &azsecrets.ClientOptions{
 			ClientOptions: azcore.ClientOptions{
 				Transport: &http.Client{
 					Transport: &http.Transport{
 						TLSClientConfig: &tls.Config{
-							InsecureSkipVerify: true, //nolint:gosec // emulator only
+							RootCAs: caPool,
 						},
 					},
 				},
EOF