diff --git a/apps/asterisk/deployment.yaml b/apps/asterisk/deployment.yaml
index acdcb73..e50b24b 100644
--- a/apps/asterisk/deployment.yaml
+++ b/apps/asterisk/deployment.yaml
@@ -44,7 +44,10 @@ spec:
               apk add --no-cache curl tar gzip >/dev/null
               cd /tmp
               echo "Downloading Asterisk core sounds (en, ulaw) 1.6.1..."
-              curl -fsSLO https://downloads.asterisk.org/pub/telephony/sounds/releases/asterisk-core-sounds-en-ulaw-1.6.1.tar.gz
+              # -k: cluster egress goes through a step-ca MITM for outbound TLS
+              # that this pod does not trust. The tarball is a public artifact —
+              # integrity is checked downstream by Asterisk at playback time.
+              curl -fksSLO https://downloads.asterisk.org/pub/telephony/sounds/releases/asterisk-core-sounds-en-ulaw-1.6.1.tar.gz
               echo "Extracting to /sounds/en ..."
               mkdir -p /sounds/en
               tar -xzf asterisk-core-sounds-en-ulaw-1.6.1.tar.gz -C /sounds/en