diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts
index e38dbcfb5..ae5af701e 100644
--- a/backend/src/lib/config/env.ts
+++ b/backend/src/lib/config/env.ts
@@ -69,6 +69,9 @@ const envSchema = z
     SMTP_PASSWORD: zpStr(z.string().optional()),
     SMTP_FROM_ADDRESS: zpStr(z.string().optional()),
     SMTP_FROM_NAME: zpStr(z.string().optional().default("Infisical")),
+    SMTP_CUSTOM_CA_CERT: zpStr(
+      z.string().optional().describe("Base64 encoded custom CA certificate PEM(s) for the SMTP server")
+    ),
     COOKIE_SECRET_SIGN_KEY: z
       .string()
       .min(32)
@@ -298,6 +301,17 @@ export const initEnvConfig = (logger?: CustomLogger) => {
 };
 
 export const formatSmtpConfig = () => {
+  const tlsOptions: {
+    rejectUnauthorized: boolean;
+    ca?: string | string[];
+  } = {
+    rejectUnauthorized: envCfg.SMTP_TLS_REJECT_UNAUTHORIZED
+  };
+
+  if (envCfg.SMTP_CUSTOM_CA_CERT) {
+    tlsOptions.ca = Buffer.from(envCfg.SMTP_CUSTOM_CA_CERT, "base64").toString("utf-8");
+  }
+
   return {
     host: envCfg.SMTP_HOST,
     port: envCfg.SMTP_PORT,
@@ -309,8 +323,6 @@ export const formatSmtpConfig = () => {
     from: `"${envCfg.SMTP_FROM_NAME}" <${envCfg.SMTP_FROM_ADDRESS}>`,
     ignoreTLS: envCfg.SMTP_IGNORE_TLS,
     requireTLS: envCfg.SMTP_REQUIRE_TLS,
-    tls: {
-      rejectUnauthorized: envCfg.SMTP_TLS_REJECT_UNAUTHORIZED
-    }
+    tls: tlsOptions
   };
 };
diff --git a/docs/self-hosting/configuration/envars.mdx b/docs/self-hosting/configuration/envars.mdx
index b63c58d3a..8da732d6d 100644
--- a/docs/self-hosting/configuration/envars.mdx
+++ b/docs/self-hosting/configuration/envars.mdx
@@ -32,7 +32,7 @@ Used to configure platform-specific security and operational settings
 <ParamField query="HOST" type="string" default="localhost" optional>
   Specifies the network interface Infisical will bind to when accepting incoming connections.
 
-  By default, Infisical binds to `localhost`, which restricts access to connections from the same machine. 
+  By default, Infisical binds to `localhost`, which restricts access to connections from the same machine.
 
   To make the application accessible externally (e.g., for self-hosted deployments), set this to `0.0.0.0`, which tells the server to listen on all network interfaces.
 
@@ -95,9 +95,8 @@ The platform utilizes Postgres to persist all of its data and Redis for caching
 </ParamField>
 
 <ParamField query="DB_ROOT_CERT" type="string" default="" optional>
-  Configure the SSL certificate for securing a Postgres connection by first encoding it in base64. 
-  Use the command below to encode your certificate:
-  `echo "<certificate>" | base64`
+  Configure the SSL certificate for securing a Postgres connection by first encoding it in base64.
+  Use the following command to encode your certificate: `echo "<certificate>" | base64`
 </ParamField>
 
 <ParamField query="DB_READ_REPLICAS" type="string" default="" optional>
@@ -111,10 +110,9 @@ DB_READ_REPLICAS=[{"DB_CONNECTION_URI":""}]
     </ParamField>
     <ParamField query="DB_ROOT_CERT" type="string" default="" optional>
       Configure the SSL certificate for securing a Postgres replica connection by first encoding it in base64.
-	    Use the command below to encode your certificate:
-      `echo "<certificate>" | base64`
+	    Use the following command to encode your certificate: `echo "<certificate>" | base64`
 
-    		If not provided it will use master SSL certificate.
+      If not provided it will use master SSL certificate.
     </ParamField>
 
   </Expandable>
@@ -169,6 +167,16 @@ Without email configuration, Infisical's core functions like sign-up/login and s
 <ParamField query="SMTP_TLS_REJECT_UNAUTHORIZED" type="bool" default="true" optional>
   If this is `true`, Infisical will validate the server's SSL/TLS certificate and reject the connection if the certificate is invalid or not trusted. If set to `false`, the client will accept the server's certificate regardless of its validity, which can be useful in development or testing environments but is not recommended for production use.
 </ParamField>
+
+<ParamField query="SMTP_CUSTOM_CA_CERT" type="string" default="none" optional>
+    If your SMTP server uses a certificate signed by a custom Certificate Authority, you should set this variable so that Infisical can trust the custom CA.
+
+    This variable **must be a base64 encoded PEM certificate**. Use the following command to encode your certificate: `echo "<certificate>" | base64`
+
+    Infisical highly encourages the following variables be used alongside this one for maximum security:
+    - `SMTP_REQUIRE_TLS=true`
+    - `SMTP_TLS_REJECT_UNAUTHORIZED=true`
+</ParamField>
 </Accordion>
 
 <Accordion title="Twilio SendGrid">
@@ -222,7 +230,7 @@ SMTP_FROM_NAME=Infisical
       This will be used to verify the email you are sending from.
       ![Create SES identity](../../images/self-hosting/configuration/email/ses-create-identity.png)
       <Info>
-        If you AWS SES is under sandbox mode, you will only be able to send emails to verified identies. 
+        If you AWS SES is under sandbox mode, you will only be able to send emails to verified identies.
       </Info>
     </Step>
     <Step title="Create an account and configure AWS SES">
@@ -388,9 +396,9 @@ SMTP_FROM_NAME=Infisical
   </Info>
 </Accordion>
 
-<Accordion title="SMTP2Go"> 
+<Accordion title="SMTP2Go">
 1. Create an account and configure [SMTP2Go](https://www.smtp2go.com/) to send emails.
-2. Turn on SMTP authentication  
+2. Turn on SMTP authentication
 ```
 SMTP_HOST=mail.smtp2go.com
 SMTP_PORT=You can use one of the following ports: 2525, 80, 25, 8025, or 587
@@ -401,7 +409,7 @@ SMTP_FROM_NAME=Infisical
 ```
 {" "}
 
-<Note> 
+<Note>
 Optional (for TLS/SSL):
 
 TLS: Available on the same ports (2525, 80, 25, 8025, or 587)