diff --git a/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset b/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset
index 330fc962..9abc2cc7 100644
--- a/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset
+++ b/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset
@@ -1,4 +1,6 @@
 enable aurora-groups.service
+enable bootc-update-ca-trust.service
+enable bootc-update-crypto-policies.service
 enable brew-setup.service
 enable dconf-update.service
 enable flatpak-preinstall.service
diff --git a/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service b/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service
new file mode 100644
index 00000000..4b4eb641
--- /dev/null
+++ b/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service
@@ -0,0 +1,18 @@
+# Regenerate files preserved by the /etc three-way merge after image upgrades.
+[Unit]
+Description=Regenerate CA certificate trust store
+Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
+ConditionPathIsMountPoint=/sysroot
+ConditionPathExists=/usr/bin/update-ca-trust
+DefaultDependencies=no
+Requires=local-fs.target
+After=local-fs.target
+Before=sysinit.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/bin/update-ca-trust extract
+
+[Install]
+WantedBy=sysinit.target
diff --git a/system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service b/system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service
new file mode 100644
index 00000000..f77a4a3b
--- /dev/null
+++ b/system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service
@@ -0,0 +1,18 @@
+# Regenerate backend files preserved by the /etc three-way merge after image upgrades.
+[Unit]
+Description=Regenerate crypto-policies backend configuration
+Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
+ConditionPathIsMountPoint=/sysroot
+ConditionPathExists=/usr/bin/update-crypto-policies
+DefaultDependencies=no
+Requires=local-fs.target
+After=local-fs.target
+Before=sysinit.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/bin/bash -ec 'policy=$(/usr/bin/update-crypto-policies --show); exec /usr/bin/update-crypto-policies --set "$$policy"'
+
+[Install]
+WantedBy=sysinit.target