I've previously used an init script to locally inject certs into Gradle's JVM without having to modify the JDK installation, it's a hack but it does run early enough
that's not gonna help with provisioned toolchains but if they're running your own code then you just need to similarly add your own certs at runtime instead of using the system keystore