diff --git a/Dockerfile b/Dockerfile
index ad7d6e8c..7aa1e1e3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,6 +13,7 @@ RUN opam config exec -- dune build \
 
 FROM debian:10
 RUN apt-get update && apt-get install libev4 libsqlite3-0 -y --no-install-recommends
+RUN apt-get install ca-certificates -y  # https://github.com/mirage/ocaml-conduit/issues/388
 WORKDIR /var/lib/ocluster-scheduler
 ENTRYPOINT ["/usr/local/bin/ocluster-scheduler"]
 COPY --from=build \
diff --git a/README.md b/README.md
index 0fb12eca..764f6128 100644
--- a/README.md
+++ b/README.md
@@ -391,7 +391,7 @@ The `scheduler` service also writes out `./capnp-secrets/stress-admin.cap`, whic
 For example:
 
 ```
-dune exec -- ocluster-admin show ./capnp-secrets/stress-admin.cap linux-x86_64
+dune exec -- ocluster-admin show -c ./capnp-secrets/stress-admin.cap linux-x86_64
 ```
 
 You can also create your own client endpoints and submit your own jobs, in addition to those submitted by the testbed itself.
diff --git a/stress/Dockerfile b/stress/Dockerfile
index e8480a2c..837e9dba 100644
--- a/stress/Dockerfile
+++ b/stress/Dockerfile
@@ -1,2 +1,3 @@
 FROM debian:10
 RUN apt-get update && apt-get install libev4 libsqlite3-0 -y --no-install-recommends
+RUN apt-get install ca-certificates -y  # https://github.com/mirage/ocaml-conduit/issues/388