diff --git a/bin/y-build b/bin/y-build
index 6b660bad..dcf794c5 100755
--- a/bin/y-build
+++ b/bin/y-build
@@ -9,6 +9,8 @@ set -eo pipefail
 #   --format <oci|tarball> format for --output, as in crane pull --format (default oci)
 #   --tarball <path>       shorthand for --output <path> --format tarball
 #   --push=false           skip push to registry
+# Env BUILDKIT_HOST selects buildkitd (default: ystack's in-cluster one), and BUILDKIT_TLS_DIR
+# its TLS client files (see y-buildctl).
 BUILDCTL_OPTS=""
 FILE_OUTPUT=""
 OUTPUT_PATH=""
@@ -155,6 +157,10 @@ fi
 DEFAULT_REGISTRY=builds-registry.ystack.svc.cluster.local
 [ -z "$BUILDS_REGISTRY" ] && BUILDS_REGISTRY=$DEFAULT_REGISTRY
 [ -z "$PUSH_REGISTRY" ]   && PUSH_REGISTRY=$DEFAULT_REGISTRY
+if [ -z "$BUILDKIT_HOST" ] && [ -n "$BUILDKIT_TLS_DIR" ]; then
+  echo "ERROR BUILDKIT_TLS_DIR is set but BUILDKIT_HOST is not; ystack's in-cluster buildkitd has no TLS" >&2
+  exit 1
+fi
 if [ -z "$BUILDKIT_HOST" ]; then
   BUILDKIT_HOSTNAME=buildkitd.ystack.svc.cluster.local
   # Prefer port 80 (Gateway API) for local clusters, fall back to 8547 (y-kubefwd for remote clusters)
diff --git a/bin/y-buildctl b/bin/y-buildctl
index 51e1d8ed..2e4c3537 100755
--- a/bin/y-buildctl
+++ b/bin/y-buildctl
@@ -5,4 +5,8 @@ YBIN="$(dirname $0)"
 
 version=$(y-bin-download $YBIN/y-bin.runner.yaml buildctl)
 
+# buildctl takes TLS client files only as flags; BUILDKIT_HOST is its only env.
+# BUILDKIT_TLS_DIR holds ca.pem, cert.pem and key.pem, the layout of DOCKER_CERT_PATH.
+[ -z "$BUILDKIT_TLS_DIR" ] || set -- --tlsdir "$BUILDKIT_TLS_DIR" "$@"
+
 y-buildctl-v${version}-bin "$@" || exit $?