diff --git a/src/google/adk/cli/cli_deploy.py b/src/google/adk/cli/cli_deploy.py
index 2a3e5627247..76fe2c939cb 100644
--- a/src/google/adk/cli/cli_deploy.py
+++ b/src/google/adk/cli/cli_deploy.py
@@ -182,6 +182,14 @@ def _ensure_agent_engine_dependency(requirements_txt_path: str) -> None:
 # Create a non-root user
 RUN adduser --disabled-password --gecos "" myuser
 
+# Optional Agent Gateway intercept CA (Cloud Build build-arg)
+ARG AGENT_GATEWAY_ROOT_CERTIFICATES
+RUN if [ -n "$AGENT_GATEWAY_ROOT_CERTIFICATES" ]; then \\
+      mkdir -p /usr/local/share/ca-certificates && \\
+      echo "$AGENT_GATEWAY_ROOT_CERTIFICATES" > /usr/local/share/ca-certificates/agw-ca.crt && \\
+      update-ca-certificates; \\
+    fi
+
 # Switch to the non-root user
 USER myuser
 
diff --git a/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py b/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py
index 35ebd636ab7..8a3f8743ecf 100644
--- a/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py
+++ b/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py
@@ -40,6 +40,16 @@ def __call__(self, *, include_requirements: bool, include_env: bool) -> Path:
     ...
 
 
+def test_dockerfile_template_consumes_agent_gateway_root_certificates() -> None:
+  """The shared deploy template must declare and consume the Cloud Build ARG."""
+  content = cli_deploy._DOCKERFILE_TEMPLATE
+  assert "ARG AGENT_GATEWAY_ROOT_CERTIFICATES" in content
+  assert "update-ca-certificates" in content
+  assert content.index("ARG AGENT_GATEWAY_ROOT_CERTIFICATES") < content.index(
+      "USER myuser"
+  )
+
+
 # Helpers
 class _Recorder:
   """A callable object that records every invocation."""
@@ -150,6 +160,11 @@ def test_to_cloud_run_happy_path(
       'RUN adduser --disabled-password --gecos "" myuser' in dockerfile_content
   )
   assert "USER myuser" in dockerfile_content
+  assert "ARG AGENT_GATEWAY_ROOT_CERTIFICATES" in dockerfile_content
+  assert "update-ca-certificates" in dockerfile_content
+  assert dockerfile_content.index(
+      "ARG AGENT_GATEWAY_ROOT_CERTIFICATES"
+  ) < dockerfile_content.index("USER myuser")
   assert "ENV GOOGLE_CLOUD_PROJECT=proj" in dockerfile_content
   assert "ENV GOOGLE_CLOUD_LOCATION=asia-northeast1" in dockerfile_content
   assert 'RUN pip install "google-adk[a2a]==1.3.0"' in dockerfile_content