diff --git a/CHANGELOG.md b/CHANGELOG.md
index c081cd00..fd5d1cb8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,10 @@
 # Changelog
 
-## Pending
+## [3.5.5] 2026-09-15
+- Bumped core-agent to 1.6.0
+- Add `core_agent_ca_cert` config option to pass `--ca-cert` to the Core Agent
+
+## [3.5.4] 2026-09-15
 - Fix FastMCP tool annotation tags (`read_only`/`idempotent`/`external`/`destructive`) under FastMCP 4.x (MCP SDK v2), which renamed the `ToolAnnotations` hint fields from camelCase to snake_case; reads now try snake_case then camelCase, keeping FastMCP 2.x/3.x support
 - Bump flake8 pre-commit hook to 7.3.0 for Python 3.12+ compatibility (pyflakes no longer crashes on `ast.Str`)
 - Fix `rq` instrumentation: use `Job.id` property instead of removed `get_id()` (#851)
diff --git a/setup.py b/setup.py
index 126966dd..5895f8f5 100644
--- a/setup.py
+++ b/setup.py
@@ -33,7 +33,7 @@
 
 setup(
     name="scout_apm",
-    version="3.5.3",
+    version="3.5.5",
     description="Scout Application Performance Monitoring Agent",
     long_description=long_description,
     long_description_content_type="text/markdown",
diff --git a/src/scout_apm/core/agent/manager.py b/src/scout_apm/core/agent/manager.py
index df0650c7..613da31d 100644
--- a/src/scout_apm/core/agent/manager.py
+++ b/src/scout_apm/core/agent/manager.py
@@ -69,6 +69,7 @@ def run(self):
                         + self.log_file()
                         + self.config_file()
                         + self.socket_path()
+                        + self.ca_cert()
                     ),
                     close_fds=True,
                     stdout=devnull,
@@ -129,6 +130,14 @@ def config_file(self):
         else:
             return []
 
+    def ca_cert(self):
+        path = scout_config.value("core_agent_ca_cert")
+
+        if path is not None:
+            return ["--ca-cert", path]
+        else:
+            return []
+
     def verify(self):
         manifest = parse_manifest(self.core_agent_dir + "/manifest.json")
         if manifest is None:
diff --git a/src/scout_apm/core/config.py b/src/scout_apm/core/config.py
index 7e22b470..2b3152eb 100644
--- a/src/scout_apm/core/config.py
+++ b/src/scout_apm/core/config.py
@@ -63,6 +63,7 @@ def log(self) -> None:
         "app_server",
         "application_root",
         "collect_remote_ip",
+        "core_agent_ca_cert",
         "core_agent_config_file",
         "core_agent_dir",
         "core_agent_download",
@@ -229,7 +230,7 @@ def __init__(self):
             "core_agent_log_level": "info",
             "core_agent_permissions": 700,
             "core_agent_socket_path": "tcp://127.0.0.1:6590",
-            "core_agent_version": "v1.5.1",  # can be an exact tag name, or 'latest'
+            "core_agent_version": "v1.6.0",  # can be an exact tag name, or 'latest'
             "disabled_instruments": [],
             "download_url": (
                 "https://s3-us-west-1.amazonaws.com/scout-public-downloads/"
diff --git a/tests/unit/core/agent/test_manager.py b/tests/unit/core/agent/test_manager.py
index f13cdc99..924e5aef 100644
--- a/tests/unit/core/agent/test_manager.py
+++ b/tests/unit/core/agent/test_manager.py
@@ -93,6 +93,21 @@ def test_config_file_old_name_takes_precedence(self):
 
         assert result == ["--config-file", "foo"]
 
+    def test_ca_cert(self):
+        scout_config.set(core_agent_ca_cert="foo")
+
+        try:
+            result = CoreAgentManager().ca_cert()
+        finally:
+            scout_config.reset_all()
+
+        assert result == ["--ca-cert", "foo"]
+
+    def test_ca_cert_not_set(self):
+        result = CoreAgentManager().ca_cert()
+
+        assert result == []
+
 
 class TestParseManifest(object):
     def test_fail_does_not_exist(self, caplog, tmp_path):