diff --git a/CHANGELOG.md b/CHANGELOG.md
index 87c1050c39..37f75e952b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 ## HEAD
 
+### Add support for IBM Z operating system z/OS
+* Add build tags for zos
+
 ### Chrome CT Policy Update
  * #906: Update chromepolicy.go to follow the updated Chrome CT policy.
  
diff --git a/x509/root_unix.go b/x509/root_unix.go
index d00842a81d..8f2821b1d8 100644
--- a/x509/root_unix.go
+++ b/x509/root_unix.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build dragonfly || freebsd || linux || netbsd || openbsd || solaris
-// +build dragonfly freebsd linux netbsd openbsd solaris
+//go:build dragonfly || freebsd || linux || netbsd || openbsd || solaris || zos
+// +build dragonfly freebsd linux netbsd openbsd solaris zos
 
 package x509
 
diff --git a/x509/root_unix_test.go b/x509/root_unix_test.go
index 7b7ff575cd..12a9c58de7 100644
--- a/x509/root_unix_test.go
+++ b/x509/root_unix_test.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build dragonfly || freebsd || linux || netbsd || openbsd || solaris
-// +build dragonfly freebsd linux netbsd openbsd solaris
+//go:build dragonfly || freebsd || linux || netbsd || openbsd || solaris || zos
+// +build dragonfly freebsd linux netbsd openbsd solaris zos
 
 package x509
 
diff --git a/x509/root_zos.go b/x509/root_zos.go
new file mode 100644
index 0000000000..54f240af07
--- /dev/null
+++ b/x509/root_zos.go
@@ -0,0 +1,13 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build zos
+// +build zos
+
+package x509
+
+// Possible certificate files; stop after finding one.
+var certFiles = []string{
+	"/etc/cacert.pem", // IBM zOS default
+}