diff --git a/.github/in-cluster-test-scripts/external-workloads-install.sh b/.github/in-cluster-test-scripts/external-workloads-install.sh
index 5d09b32c25..293c93d02c 100644
--- a/.github/in-cluster-test-scripts/external-workloads-install.sh
+++ b/.github/in-cluster-test-scripts/external-workloads-install.sh
@@ -9,7 +9,7 @@ cilium install \
   --version "${CILIUM_VERSION}" \
   --cluster-name "${CLUSTER_NAME}" \
   --helm-set bpf.monitorAggregation=none \
-  --helm-set=extraConfig.tunnel=vxlan \
+  --helm-set routingMode=tunnel \
   --helm-set kubeProxyReplacement=strict \
   --helm-set loadBalancer.l7.backend=envoy \
   --helm-set tls.secretsBackend=k8s \
diff --git a/Dockerfile b/Dockerfile
index d026a37fe9..5fd3894e84 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,12 +5,13 @@
 
 FROM docker.io/library/golang:1.20.4-alpine3.16@sha256:6469405d7297f82d56195c90a3270b0806ef4bd897aa0628477d9959ab97a577 as builder
 WORKDIR /go/src/github.com/cilium/cilium-cli
-RUN apk add --no-cache git make
+RUN apk add --no-cache git make ca-certificates
 COPY . .
 RUN make
 
 FROM docker.io/library/busybox:stable-glibc@sha256:7338d0c72c655d6534670ed72590cdc99afc9c559958c47eb3a5a17a7520a75c
 LABEL maintainer="maintainer@cilium.io"
+COPY --from=builder /etc/ssl/certs /etc/ssl/certs
 COPY --from=builder /go/src/github.com/cilium/cilium-cli/cilium /usr/local/bin/cilium
 RUN ["wget", "-P", "/usr/local/bin", "https://dl.k8s.io/release/v1.23.6/bin/linux/amd64/kubectl"]
 RUN ["chmod", "+x", "/usr/local/bin/kubectl"]