diff --git a/package.json b/package.json
index f08b7ee..afb410c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "proxmox-spice-client",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "VDI SPICE Client f\u00fcr Proxmox",
   "main": "src/main.js",
   "scripts": {
diff --git a/src/main.js b/src/main.js
index 90499e1..fbdb097 100644
--- a/src/main.js
+++ b/src/main.js
@@ -280,10 +280,13 @@ function buildVVFile(params, vmid, client) {
   if (params.password) lines.push(`password=${params.password}`);
   if (params.proxy) lines.push(`proxy=${params.proxy}`);
 
+  // virt-viewer's .vv format only understands the CA inline via `ca=`, with
+  // newlines escaped as literal "\n" -- there is no `tls-ca-file=<path>` key,
+  // so pointing at a temp .pem file was silently ignored and left the
+  // self-signed cluster CA unverified, failing the TLS handshake.
   if (params.ca) {
-    const caPath = path.join(os.tmpdir(), 'proxmox-spice-ca.pem');
-    fs.writeFileSync(caPath, params.ca);
-    lines.push(`tls-ca-file=${caPath}`);
+    const caInline = String(params.ca).replace(/\r\n|\r|\n/g, '\\n');
+    lines.push(`ca=${caInline}`);
   }
   if (params['host-subject']) lines.push(`host-subject=${params['host-subject']}`);