diff --git a/src/aare/gui/auth.py b/src/aare/gui/auth.py
index 45d15f25..30c3e923 100644
--- a/src/aare/gui/auth.py
+++ b/src/aare/gui/auth.py
@@ -20,6 +20,7 @@ def auth(base_url: str | None, cert_path: str | None) -> str:
     # Single call: Kerberos SPNEGO through Apache, which proxies to the DAQ server.
     # Apache injects X-Remote-User; the DAQ server reads it from the localhost-proxied request.
     url = f"{base_url}/token"
+    cacert = f"{cert_path}"
     try:
         token_result = subprocess.run(
             ['curl', '-s', '--cacert', CACERT,