diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 282537a..039aa0e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -42,9 +42,6 @@ jobs:
       - name: Integration Test
         run: |
           echo "Testing initial install"
-          # Create ./certificates here because install.sh will create it with root:root
-          # and then run.sh (-> setup.sh) won't be able to write to it.
-          mkdir certificates
           ./install.sh
           ./_integration-test/run.sh
           echo "Testing in-place upgrade"
diff --git a/.gitignore b/.gitignore
index c8967cd..4a86daa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -88,9 +88,6 @@ geoip/.geoipupdate.lock
 # wal2json download
 postgres/wal2json
 
-# custom certificate authorities
-certificates
-
 # integration testing
 _integration-test/custom-ca-roots/nginx/*
 sentry/test-custom-ca-roots.py
diff --git a/certificates/.gitignore b/certificates/.gitignore
new file mode 100644
index 0000000..30d0607
--- /dev/null
+++ b/certificates/.gitignore
@@ -0,0 +1,3 @@
+# Add all custom CAs in this folder
+*
+!.gitignore