diff --git a/changes/38699-ca-cert-country b/changes/38699-ca-cert-country
new file mode 100644
index 0000000000..be89949315
--- /dev/null
+++ b/changes/38699-ca-cert-country
@@ -0,0 +1 @@
+- Added Country:US to new CA certs created by Fleet.
diff --git a/ee/server/service/condaccess/config.go b/ee/server/service/condaccess/config.go
index 99656bb18a..980f366e26 100644
--- a/ee/server/service/condaccess/config.go
+++ b/ee/server/service/condaccess/config.go
@@ -37,6 +37,7 @@ func initAssets(ctx context.Context, ds fleet.Datastore) error {
 			depot.WithCommonName("Fleet conditional access CA"),
 			// Signal that the CA is local to the deployment and not necessarily managed by Fleet or another external vendor
 			depot.WithOrganization("Local certificate authority"),
+			depot.WithCountry("US"),
 		)
 		scepCert, scepKey, err := depot.NewCACertKey(caCert)
 		if err != nil {
@@ -69,6 +70,7 @@ func initAssets(ctx context.Context, ds fleet.Datastore) error {
 			depot.WithYears(10),
 			depot.WithCommonName("Fleet conditional access IdP"),
 			depot.WithOrganization("Local certificate authority"),
+			depot.WithCountry("US"),
 		)
 		idpCertX509, idpKey, err := depot.NewCACertKey(idpCert)
 		if err != nil {
diff --git a/ee/server/service/hostidentity/config.go b/ee/server/service/hostidentity/config.go
index 429ef6cfec..cac57d1228 100644
--- a/ee/server/service/hostidentity/config.go
+++ b/ee/server/service/hostidentity/config.go
@@ -30,6 +30,7 @@ func initAssets(ds fleet.Datastore) error {
 			depot.WithCommonName("Fleet Host Identity CA"),
 			// Signal that the CA is local to the deployment and not necessarily managed by Fleet or another external vendor
 			depot.WithOrganization("Local Certificate Authority"),
+			depot.WithCountry("US"),
 		)
 		scepCert, scepKey, err := depot.NewCACertKey(caCert)
 		if err != nil {
diff --git a/server/mdm/scep/depot/fleet.go b/server/mdm/scep/depot/fleet.go
index 41f6a8b0d1..3efa0b4279 100644
--- a/server/mdm/scep/depot/fleet.go
+++ b/server/mdm/scep/depot/fleet.go
@@ -33,6 +33,7 @@ func NewSCEPCACertKey() (*x509.Certificate, *rsa.PrivateKey, error) {
 	caCert := NewCACert(
 		WithYears(10),
 		WithCommonName("Fleet"),
+		WithCountry("US"),
 	)
 	return NewCACertKey(caCert)
 }