diff --git a/nix/host-modules/swarm-grafana.nix b/nix/host-modules/swarm-grafana.nix
index 513d315f..b8b94d72 100644
--- a/nix/host-modules/swarm-grafana.nix
+++ b/nix/host-modules/swarm-grafana.nix
@@ -1340,6 +1340,14 @@ in
               # from anything that mentions Grafana.
               metrics.enabled = true;
 
+              # Grafana hands an external backend plugin only an allow-list of
+              # its environment (the proxy variables), so without this the logs
+              # datasource never sees the unit's `SSL_CERT_FILE` and rejects the
+              # log store's certificate as `x509: unknown authority`. The value
+              # is plugin ids, not variable names: each listed plugin gets the
+              # whole environment.
+              plugins.forward_host_env_vars = "victoriametrics-logs-datasource";
+
               users.auto_assign_org_role = cfg.oidc.role;
 
               # ⚠️ `$__file{}`, and required rather than optional: nixpkgs
diff --git a/nix/module-eval/grafana.nix b/nix/module-eval/grafana.nix
index b2dca213..ec1058f9 100644
--- a/nix/module-eval/grafana.nix
+++ b/nix/module-eval/grafana.nix
@@ -426,6 +426,22 @@ let
         && logs.jsonData.httpHeaderName1 == "Authorization"
         && logs.secureJsonData.httpHeaderValue1 == metrics.secureJsonData.httpHeaderValue1;
     }
+    {
+      # An external plugin inherits only Grafana's proxy variables unless its
+      # id is listed here, and without `SSL_CERT_FILE` every logs query fails
+      # `x509: unknown authority`. Compared against the provisioned
+      # datasource's `type`, so renaming one side without the other fails.
+      name = "the logs datasource's plugin is handed Grafana's environment";
+      ok =
+        let
+          grafana = grafanaWithAuthelia.containers.swarm-grafana.config.services.grafana;
+          logs = lib.findFirst (
+            d: d.uid == "swarm-victorialogs"
+          ) null grafana.provision.datasources.settings.datasources;
+        in
+        logs != null
+        && lib.elem logs.type (lib.toList (grafana.settings.plugins.forward_host_env_vars or [ ]));
+    }
     {
       # The reader's half of the same mapping. The collector writes a severity
       # TEXT; nothing downstream reads it as a level unless the datasource is