diff --git a/docs/runtime/environment-variables.mdx b/docs/runtime/environment-variables.mdx
index bff70123a229..0b73575ebeac 100644
--- a/docs/runtime/environment-variables.mdx
+++ b/docs/runtime/environment-variables.mdx
@@ -208,6 +208,8 @@ Bun reads these environment variables to configure aspects of its behavior.
 | Name                                     | Description                                                                                                                                                                                                                                                                                                                                                                   |
 | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `NODE_TLS_REJECT_UNAUTHORIZED`           | `NODE_TLS_REJECT_UNAUTHORIZED=0` disables SSL certificate validation. Useful for testing and debugging, but be very hesitant to use it in production. Node.js introduced this variable; Bun keeps the name for compatibility.                                                                                                                                                 |
+| `SSL_CERT_FILE`                          | Path to a PEM file of CA certificates. Bun trusts these certificates in addition to its bundled root certificates, for example in `fetch`, `node:https`, `node:tls`, and `WebSocket`. If unset, Bun reads `/etc/ssl/cert.pem`. If set to an empty string, Bun reads no file. OpenSSL introduced this variable. Bun keeps the name for compatibility.                          |
+| `SSL_CERT_DIR`                           | Directories of CA certificates that Bun trusts in addition to its bundled root certificates. Name each certificate file by its subject hash (`<hash>.0`), the layout that `openssl rehash` creates. Separate directories with `:` (`;` on Windows). If unset, Bun reads `/etc/ssl/certs`. OpenSSL introduced this variable. Bun keeps the name for compatibility.             |
 | `BUN_CONFIG_VERBOSE_FETCH`               | If `BUN_CONFIG_VERBOSE_FETCH=curl`, then fetch requests log the URL, method, request headers and response headers to the console. This also works with `node:http`. `BUN_CONFIG_VERBOSE_FETCH=1` is equivalent to `BUN_CONFIG_VERBOSE_FETCH=curl` except without the `curl` output.                                                                                           |
 | `BUN_RUNTIME_TRANSPILER_CACHE_PATH`      | The runtime transpiler caches the transpiled output of source files larger than 4 KB, which makes CLIs using Bun load faster. If `BUN_RUNTIME_TRANSPILER_CACHE_PATH` is set, Bun writes the cache to that directory. If it is set to an empty string or the string `"0"`, caching is disabled. If it is unset, Bun writes the cache to the platform-specific cache directory. |
 | `TMPDIR`                                 | Bun occasionally requires a directory to store intermediate assets during bundling or other operations. If unset, defaults to the platform-specific temporary directory: `/tmp` on Linux, `/private/tmp` on macOS.                                                                                                                                                            |