diff --git a/images/runtimes/nodejs22.2.0/Dockerfile.x86_64 b/images/runtimes/nodejs22.2.0/Dockerfile.x86_64
index ce47d064eed..b69d1dd5843 100644
--- a/images/runtimes/nodejs22.2.0/Dockerfile.x86_64
+++ b/images/runtimes/nodejs22.2.0/Dockerfile.x86_64
@@ -26,6 +26,12 @@ RUN make -j $(nproc) test-build
 RUN out/Release/node --check test/common/index.js \
   && out/Release/node --check test/parallel/test-http-outgoing-end-cork.js
 
+# Select the certificate for www.nodejs.org in the CA interaction test.
+COPY tls-servername.patch /tmp/tls-servername.patch
+RUN patch -p1 --no-backup-if-mismatch < /tmp/tls-servername.patch \
+  && out/Release/node --check test/internet/test-tls-add-ca-cert.js \
+  && rm -f /tmp/tls-servername.patch
+
 # Including dumb-init emulates the Linux "init" process, preventing the failure
 # of tests involving worker processes.
 ENTRYPOINT ["/usr/bin/dumb-init"]
diff --git a/images/runtimes/nodejs22.2.0/tls-servername.patch b/images/runtimes/nodejs22.2.0/tls-servername.patch
new file mode 100644
index 00000000000..900c8c3f5d5
--- /dev/null
+++ b/images/runtimes/nodejs22.2.0/tls-servername.patch
@@ -0,0 +1,14 @@
+# tls.connect does not send SNI by default, so the server otherwise
+# selects its default certificate instead of the one for www.nodejs.org.
+# https://nodejs.org/api/tls.html#tlsconnectoptions-callback
+# Upstream: https://github.com/nodejs/node/pull/66835
+diff --git a/test/internet/test-tls-add-ca-cert.js b/test/internet/test-tls-add-ca-cert.js
+--- a/test/internet/test-tls-add-ca-cert.js
++++ b/test/internet/test-tls-add-ca-cert.js
+@@ -27,5 +27,6 @@ const caCert = loadPEM('ca1-cert');
+ const opts = {
+   host: 'www.nodejs.org',
++  servername: 'www.nodejs.org',
+   port: 443,
+   rejectUnauthorized: true,
+ };