diff --git a/src/container/index.ts b/src/container/index.ts
index 5715028..05721ba 100644
--- a/src/container/index.ts
+++ b/src/container/index.ts
@@ -152,11 +152,13 @@ export class ContainerClient {
       args.push("-e", `${key}=${value}`);
     }
 
-    // Write CA certificate to host temp file and mount into container
+    // Write CA certificate to host temp file and mount into container.
+    // `,z` is a shared SELinux relabel so the container can read the cert
+    // on enforcing systems (Fedora + podman). No-op on non-SELinux hosts.
     const hostCaPath = writeCaCertificate(config.caCertificate);
     args.push(
       "-v",
-      `${hostCaPath}:${config.caCertificateContainerPath}:ro`,
+      `${hostCaPath}:${config.caCertificateContainerPath}:ro,z`,
     );
 
     // Build combined CA bundle for system-wide trust (curl, Python, Go, etc.)
@@ -166,7 +168,7 @@ export class ContainerClient {
         args.push("-e", "SSL_CERT_FILE=/tmp/onecli-combined-ca.pem");
         // DENO_CERT: Deno does not respect SSL_CERT_FILE, it has its own env var
         args.push("-e", "DENO_CERT=/tmp/onecli-combined-ca.pem");
-        args.push("-v", `${combinedPath}:/tmp/onecli-combined-ca.pem:ro`);
+        args.push("-v", `${combinedPath}:/tmp/onecli-combined-ca.pem:ro,z`);
       }
     }
 
diff --git a/test/container/client.test.ts b/test/container/client.test.ts
index b65f8c0..1f06eb2 100644
--- a/test/container/client.test.ts
+++ b/test/container/client.test.ts
@@ -256,9 +256,9 @@ describe("ContainerClient", () => {
       });
 
       const expectedHostPath = join(tmpdir(), "onecli-proxy-ca.pem");
-      const mountArg = args.find((a) => a.includes(":") && a.includes("onecli-proxy-ca.pem") && a.endsWith(":ro"));
+      const mountArg = args.find((a) => a.includes(":") && a.includes("onecli-proxy-ca.pem") && a.includes(":ro"));
       expect(mountArg).toBe(
-        `${expectedHostPath}:${MOCK_CONFIG.caCertificateContainerPath}:ro`,
+        `${expectedHostPath}:${MOCK_CONFIG.caCertificateContainerPath}:ro,z`,
       );
     });