Adding:
NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
Instead of any of these works:
DEFAULT_CA_BUNDLE_PATH = "${cacert}/etc/ssl/certs/ca-bundle.crt";
REQUESTS_CA_BUNDLE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
Thanks to @Sandro for providing the solution on Mastodon.