diff --git a/third_party/nixpkgs/pkgs/applications/version-management/mercurial/default.nix b/third_party/nixpkgs/pkgs/applications/version-management/mercurial/default.nix
index 8320491758..d3d5005d40 100644
--- a/third_party/nixpkgs/pkgs/applications/version-management/mercurial/default.nix
+++ b/third_party/nixpkgs/pkgs/applications/version-management/mercurial/default.nix
@@ -11,6 +11,7 @@
 , which
 , sqlite
 , git
+, cacert
 , gnupg
 }:
 
@@ -70,11 +71,15 @@ let
       git
       gnupg
     ];
+    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";  # needed for git
     checkPhase = ''
       cat << EOF > tests/blacklists/nix
       # tests enforcing "/usr/bin/env" shebangs, which are patched for nix
       test-run-tests.t
       test-check-shbang.t
+
+      # git tests, which are somewhat unstable (native git support is very experimental)
+      test-git-interop.t
       EOF
 
       # extended timeout necessary for tests to pass on the busy CI workers