diff --git a/src/components/sidebar.tsx b/src/components/sidebar.tsx
index 7451c843be..9fd7914da0 100644
--- a/src/components/sidebar.tsx
+++ b/src/components/sidebar.tsx
@@ -103,6 +103,7 @@ export default () => {
         </div>
         <ul className="list-unstyled" data-sidebar-tree>
           <SidebarLink to="/self-hosted/">Overview</SidebarLink>
+          <SidebarLink to="/self-hosted/custom-ca-roots/">Custom CA Roots</SidebarLink>
           <SidebarLink to="/self-hosted/email/">Email</SidebarLink>
           <SidebarLink to="/self-hosted/geolocation/">Geolocation</SidebarLink>
           <SidebarLink to="/self-hosted/sso/">Single Sign-On (SSO)</SidebarLink>
diff --git a/src/docs/self-hosted/custom-ca-roots.mdx b/src/docs/self-hosted/custom-ca-roots.mdx
new file mode 100644
index 0000000000..ee40e80147
--- /dev/null
+++ b/src/docs/self-hosted/custom-ca-roots.mdx
@@ -0,0 +1,22 @@
+---
+title: "Self-Hosted Custom CA Roots"
+---
+
+Starting with Sentry `21.8.0`, if you need to have Sentry access services which do not have TLS certificates from publicly trusted CA roots, it's now possible to easily add them to the containers. Just add the certificates to the `certificates` folder inside the root of your Sentry install and restart the containers. Your custom CA roots will be used in addition to the publicly trusted CA roots.
+
+<Alert title="Note" level="info">
+  While you can run <a href="https://manpages.debian.org/buster/ca-certificates/update-ca-certificates.8.en.html"><code>update-ca-certificates</code></a> in each container, that will update the system's root bundle on disk, but does nothing for any copies in memory. Restarting the container will update the bundle and make sure it is used.
+</Alert>
+
+The container's logs will have the output from `update-ca-certificates` right at the start if there is a problem with a given certificate.
+
+## Dependencies With Bundled Roots
+
+Some dependencies have opted to bundle their own CA roots and ignore the system CA roots. Where known, they have been configured to use the system roots. If something seems to ignore the system roots, [create an issue](https://github.com/getsentry/onpremise/issues/new?template=bug.yml) so it can be tracked down and fixed.
+
+### Overridden Bundled Roots
+
+- Python
+  - `requests`
+  - `botocore`
+  - `grpc`
diff --git a/src/docs/self-hosted/index.mdx b/src/docs/self-hosted/index.mdx
index a77e23161e..464c8dafa5 100644
--- a/src/docs/self-hosted/index.mdx
+++ b/src/docs/self-hosted/index.mdx
@@ -36,6 +36,7 @@ You can find more about configuring Sentry at [the configuration section of our
 
 Here is further information on specific configuration topics related to self-hosting:
 
+- [Custom CA Roots](/self-hosted/custom-ca-roots/)
 - [Email](/self-hosted/email/)
 - [Geolocation](/self-hosted/geolocation/)
 - [Single Sign-On (SSO)](/self-hosted/sso/)