diff --git a/src/google/adk/cli/cli_deploy.py b/src/google/adk/cli/cli_deploy.py
index 6b7595adb0f..c79b713d9fa 100644
--- a/src/google/adk/cli/cli_deploy.py
+++ b/src/google/adk/cli/cli_deploy.py
@@ -73,6 +73,16 @@ def _ensure_agent_engine_dependency(requirements_txt_path: str) -> None:
 FROM python:3.11-slim
 WORKDIR /app
 
+# Optional Agent Gateway TLS interception root CA.
+# Cloud Build may pass AGENT_GATEWAY_ROOT_CERTIFICATES; without consuming it,
+# outbound HTTPS/gRPC through the gateway fails certificate verification.
+ARG AGENT_GATEWAY_ROOT_CERTIFICATES
+RUN if [ -n "$AGENT_GATEWAY_ROOT_CERTIFICATES" ]; then \
+      mkdir -p /usr/local/share/ca-certificates && \
+      echo "$AGENT_GATEWAY_ROOT_CERTIFICATES" > /usr/local/share/ca-certificates/agw-ca.crt && \
+      update-ca-certificates; \
+    fi
+
 # Create a non-root user
 RUN adduser --disabled-password --gecos "" myuser
 
diff --git a/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py b/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py
index cf11b285e77..e52dbfde5b4 100644
--- a/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py
+++ b/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py
@@ -146,6 +146,8 @@ def test_to_cloud_run_happy_path(
   expected_command = "api_server --with_ui" if with_ui else "api_server"
   assert f"CMD adk {expected_command} --port=8080" in dockerfile_content
   assert "FROM python:3.11-slim" in dockerfile_content
+  assert "ARG AGENT_GATEWAY_ROOT_CERTIFICATES" in dockerfile_content
+  assert "update-ca-certificates" in dockerfile_content
   assert (
       'RUN adduser --disabled-password --gecos "" myuser' in dockerfile_content
   )