diff --git a/README.md b/README.md
index d904a8354..e2a45f83c 100644
--- a/README.md
+++ b/README.md
@@ -67,38 +67,38 @@ Uses [LibreSSL](https://www.libressl.org/) TLS backend.
 ```
 Windows:
 Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
-Features: alt-svc AsynchDNS brotli HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets zstd
+Features: alt-svc AsynchDNS brotli CAcert HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets zstd
 
 macOS:
 Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
-Features: alt-svc AsynchDNS brotli HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6          Largefile libz NTLM PSL        SSL      threadsafe UnixSockets zstd
+Features: alt-svc AsynchDNS brotli CAcert HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6          Largefile libz NTLM PSL        SSL      threadsafe UnixSockets zstd
 
 Linux:
 Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns            mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
-Features: alt-svc AsynchDNS brotli HSTS HTTP2 HTTP3 HTTPS-proxy     IPv6          Largefile libz NTLM PSL        SSL      threadsafe UnixSockets zstd
+Features: alt-svc AsynchDNS brotli CAcert HSTS HTTP2 HTTP3 HTTPS-proxy     IPv6          Largefile libz NTLM PSL        SSL      threadsafe UnixSockets zstd
 ```
 <details><summary>Alternate configurations:</summary><p>
 
 ```
 "noh3", HTTP/2:
 Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
-Features: alt-svc AsynchDNS brotli HSTS HTTP2       HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets zstd
+Features: alt-svc AsynchDNS brotli CAcert HSTS HTTP2       HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets zstd
 
 "mini", without brotli and zstd, with OS TLS backend (Schannel, SecureTransport) if available:
 Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
-Features: alt-svc AsynchDNS        HSTS HTTP2       HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets
+Features: alt-svc AsynchDNS        CAcert HSTS HTTP2       HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets
 
 "micro", without libssh2:
 Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp          smb smbs smtp smtps telnet tftp ws wss
-Features: alt-svc AsynchDNS        HSTS HTTP2       HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets
+Features: alt-svc AsynchDNS        CAcert HSTS HTTP2       HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets
 
 "nano", HTTP/1.1:
 Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp          smb smbs smtp smtps telnet tftp ws wss
-Features:         AsynchDNS        HSTS             HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets
+Features:         AsynchDNS        CAcert HSTS             HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets
 
 "pico", HTTP/1.1-only:
 Protocols:                                   http https            ipfs ipns
-Features:         AsynchDNS        HSTS             HTTPS-proxy     IPv6          Largefile libz      PSL        SSL      threadsafe
+Features:         AsynchDNS        CAcert HSTS             HTTPS-proxy     IPv6          Largefile libz      PSL        SSL      threadsafe
 ```
 </p></details>
 
diff --git a/curl.sh b/curl.sh
index bccf47ef3..b060e372b 100755
--- a/curl.sh
+++ b/curl.sh
@@ -388,6 +388,14 @@ _VER="$1"
     fi
   fi
 
+  # Pending https://github.com/curl/curl/pull/14059
+  if [[ "${_CONFIG}" != *'nocurltool'* ]] && \
+     [[ "${_DEPS}" = *'cacert'* ]] && \
+     [ "${CURL_VER_}" != '8.8.0' ] && \
+     [ "${CURL_VER_}" != '8.9.0' ]; then
+    options+=" -DCURL_CA_EMBED=${_TOP}/cacert/${_CACERT}"
+  fi
+
   if [ "${CW_DEV_INCREMENTAL:-}" != '1' ] || [ ! -d "${_BLDDIR}" ]; then
     # shellcheck disable=SC2086
     cmake -B "${_BLDDIR}" ${_CMAKE_GLOBAL} ${options} \