Why does Swoosh + SendGrid work in development but fail in production with TLS “bad_certificate”?

Hey folks, I’m stuck on an issue with Swoosh + SendGrid in production and hoping someone has run into this before.

I'm using Phoenix + Swoosh + Finch + SendGrid (API).
Locally everything works perfectly — emails send without any issues.
But once I deploy (Fly.io), I get a TLS error:

Mint.TransportError: {:tls_alert, {:bad_certificate, ...}}

Here is my runtime.exs production config:

import Config
if config_env() == :prod do
config :tracking, Tracking.Mailer, adapter: Swoosh.Adapters.Sendgrid,
api_key: System.get_env("SENDGRID_API_KEY"),
finch_name: Tracking.Finch

config :finch, Tracking.Finch,
pools: %{
default: [
conn_opts: [ transport_opts: [
verify: :verify_peer,
cacerts: :public_certs
]
]
}
}
end

Finch is started in my application supervisor and castore is included in deps.
System CA certificates (ca-certificates) are also installed in the Fly.io image. Still, production raises a TLS bad certificate alert on every SendGrid request — but development mode works flawlessly.

Has anyone seen this difference between dev + release builds before?

Is there something extra I must configure to get Finch / Mint / Swoosh to load CA certs correctly in production?
Any pointers would help a lot 🙏