diff --git a/.gitignore b/.gitignore
index 838828a..61d58a2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,7 @@ guest/zig-cache/
 guest/zig-out/
 guest/.zig-cache/
 guest/image/out/
+image-out/
 guest/image/.cache/
 guest/fuzz/out/
 guest/fuzz/out-native/
diff --git a/guest/image/init b/guest/image/init
index b738120..143bea5 100755
--- a/guest/image/init
+++ b/guest/image/init
@@ -38,6 +38,25 @@ mount -t tmpfs tmpfs /run || log "[init] mount tmpfs failed"
 
 export PATH=/usr/sbin:/usr/bin:/sbin:/bin
 
+# Sync the system clock from the hardware RTC as early as possible.
+#
+# The host issues short-lived MITM TLS certificates whose notBefore is the
+# host wall-clock time. If the guest system clock lags behind the host (which
+# can happen depending on how the kernel initialises time on boot), freshly
+# minted certificates are seen as "certificate is not yet valid" and every
+# HTTPS request through the egress proxy (curl, apk, language runtimes, ...)
+# fails. The QEMU-exposed RTC tracks host time, so seeding the system clock
+# from it keeps the guest within the certificate validity window.
+if command -v hwclock > /dev/null 2>&1; then
+  if hwclock --hctosys --utc > /dev/null 2>&1 || hwclock -s > /dev/null 2>&1; then
+    log "[init] synced system clock from RTC: $(date -u 2>/dev/null)"
+  else
+    log "[init] hwclock RTC sync failed"
+  fi
+else
+  log "[init] hwclock not available; skipping RTC clock sync"
+fi
+
 mkdir -p /tmp /var/tmp /var/cache /var/log /root /home
 mount -t tmpfs tmpfs /tmp || log "[init] mount tmpfs /tmp failed"
 mount -t tmpfs tmpfs /root || log "[init] mount tmpfs /root failed"
diff --git a/images/alpine-base.json b/images/alpine-base.json
index 11d7b40..9e8eeb9 100644
--- a/images/alpine-base.json
+++ b/images/alpine-base.json
@@ -13,6 +13,7 @@
       "ca-certificates",
       "curl",
       "e2fsprogs",
+      "e2fsprogs-extra",
       "nodejs",
       "npm",
       "uv",