diff --git a/pkg/fn/runtime/container_utils_test.go b/pkg/fn/runtime/lister_test.go
similarity index 100%
rename from pkg/fn/runtime/container_utils_test.go
rename to pkg/fn/runtime/lister_test.go
diff --git a/pkg/fn/runtime/container_utils.go b/pkg/fn/runtime/local_lister.go
similarity index 61%
rename from pkg/fn/runtime/container_utils.go
rename to pkg/fn/runtime/local_lister.go
index 12f8f58c84..b262b7efc4 100644
--- a/pkg/fn/runtime/container_utils.go
+++ b/pkg/fn/runtime/local_lister.go
@@ -6,38 +6,8 @@ import (
 	"fmt"
 	"os/exec"
 	"strings"
-
-	"github.com/regclient/regclient"
-	regclientref "github.com/regclient/regclient/types/ref"
 )
 
-// RegClientLister is a TagLister using the regclient module to list remote OCI tags.
-type RegClientLister struct {
-	client *regclient.RegClient
-}
-
-var _ TagLister = &RegClientLister{}
-
-func (l *RegClientLister) Name() string {
-	return "regclient"
-}
-
-func (l *RegClientLister) List(ctx context.Context, image string) ([]string, error) {
-	ref, err := regclientref.New(image)
-	if err != nil {
-		return nil, err
-	}
-
-	defer func() { _ = l.client.Close(ctx, ref) }()
-
-	tagList, err := l.client.TagList(ctx, ref)
-	if err != nil {
-		return nil, err
-	}
-
-	return tagList.GetTags()
-}
-
 // LocalLister is a TagLister using the given CLI tool to list local OCI tags
 type LocalLister struct {
 	Binary string
diff --git a/pkg/fn/runtime/regclient_lister.go b/pkg/fn/runtime/regclient_lister.go
new file mode 100644
index 0000000000..48e00cdbc1
--- /dev/null
+++ b/pkg/fn/runtime/regclient_lister.go
@@ -0,0 +1,49 @@
+// Copyright 2026 The kpt Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package runtime
+
+import (
+	"context"
+
+	"github.com/regclient/regclient"
+	regclientref "github.com/regclient/regclient/types/ref"
+)
+
+// RegClientLister is a TagLister using the regclient module to list remote OCI tags.
+type RegClientLister struct {
+	Client *regclient.RegClient
+}
+
+var _ TagLister = &RegClientLister{}
+
+func (l *RegClientLister) Name() string {
+	return "regclient"
+}
+
+func (l *RegClientLister) List(ctx context.Context, image string) ([]string, error) {
+	ref, err := regclientref.New(image)
+	if err != nil {
+		return nil, err
+	}
+
+	defer func() { _ = l.Client.Close(ctx, ref) }()
+
+	tagList, err := l.Client.TagList(ctx, ref)
+	if err != nil {
+		return nil, err
+	}
+
+	return tagList.GetTags()
+}
diff --git a/pkg/fn/runtime/runner.go b/pkg/fn/runtime/runner.go
index d1a035de9d..32b77d67a7 100644
--- a/pkg/fn/runtime/runner.go
+++ b/pkg/fn/runtime/runner.go
@@ -35,6 +35,7 @@ import (
 	"github.com/kptdev/kpt/pkg/lib/runneroptions"
 	"github.com/kptdev/kpt/pkg/printer"
 	"github.com/regclient/regclient"
+	regclientreg "github.com/regclient/regclient/scheme/reg"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 	"sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil"
 	"sigs.k8s.io/kustomize/kyaml/kio/kioutil"
@@ -60,12 +61,18 @@ func NewRunner(
 		img := opts.ResolveToImage(f.Image)
 		f.Image = img
 
+		rcOpts := []regclient.Opt{
+			regclient.WithUserAgent(UserAgent),
+			regclient.WithDockerCreds(),
+		}
+
+		if len(opts.ExtraTlsCerts) != 0 {
+			regclient.WithRegOpts(regclientreg.WithCerts(opts.ExtraTlsCerts))
+		}
+
 		listers := []TagLister{
 			&RegClientLister{
-				client: regclient.New(
-					regclient.WithUserAgent(UserAgent),
-					regclient.WithDockerCreds(),
-				),
+				Client: regclient.New(rcOpts...),
 			},
 		}
 
diff --git a/pkg/lib/runneroptions/runneroptions.go b/pkg/lib/runneroptions/runneroptions.go
index 17b98e88bd..6dd2b81fec 100644
--- a/pkg/lib/runneroptions/runneroptions.go
+++ b/pkg/lib/runneroptions/runneroptions.go
@@ -66,6 +66,8 @@ type RunnerOptions struct {
 	// ImagePrefix determines the prefix ResolveToImage will use when resolving a
 	// partial image reference to a fully qualified image reference
 	ImagePrefix string
+
+	ExtraTlsCerts [][]byte
 }
 
 func (opts *RunnerOptions) InitDefaults(defaultImagePrefix string) {