diff --git a/examples/docker/README.md b/examples/docker/README.md
index fc80a002..ccf683df 100644
--- a/examples/docker/README.md
+++ b/examples/docker/README.md
@@ -12,3 +12,15 @@ docker run --privileged \
 ```
 
 The volumes keep the runner's registration and the job image cache. See [image flavours](../../README.md#image-flavours) for alternatives.
+
+#### Pull job images from a registry with a private CA
+
+The bundled Docker daemon pulls job images, so it needs to trust the registry's CA itself. `runner.ca_file` doesn't cover this. Mount the CA where the daemon looks for it, naming the directory after the registry's host and port:
+
+```sh
+--mount "type=bind,src=$PWD/ca.crt,dst=/etc/docker/certs.d/registry.example.com:5000/ca.crt,readonly"
+```
+
+Use `--mount`, since `-v` rejects a container path with a port in it.
+
+On `latest-dind-rootless`, use `/home/rootless/.config/docker/certs.d/registry.example.com:5000/ca.crt` as the target.