diff --git a/spec/vhdbuilder/packer/test/linux_vhd_content_test_helpers_spec.sh b/spec/vhdbuilder/packer/test/linux_vhd_content_test_helpers_spec.sh
index 8d0d025b5cf..ea5263575ea 100644
--- a/spec/vhdbuilder/packer/test/linux_vhd_content_test_helpers_spec.sh
+++ b/spec/vhdbuilder/packer/test/linux_vhd_content_test_helpers_spec.sh
@@ -3,6 +3,34 @@
 
 # ShellSpec tests for content-test helpers and call sites
 
+Describe 'eMudhra root removal'
+  BeforeAll "eval \"\$(sed -n '/^testEmudhraRootRemoval()/,/^}/p' vhdbuilder/packer/test/linux-vhd-content-test.sh)\""
+  err() { echo "$1:Error: $2" >&2; }
+  openssl() {
+    if [ "$1" = crl2pkcs7 ]; then
+      printf 'subject=CN = %s\n' "$CONTROL" "$ROOT"
+      return "$READ_STATUS"
+    fi
+    cat
+  }
+  Parameters
+    'DigiCert Global Root G2' '' 0 /dev/null 0
+    'DigiCert Global Root G2' 'emSign ECC Root CA - G3' 0 /dev/null 1
+    'DigiCert Global Root G2' 'AAA Certificate Services' 0 /dev/null 1
+    '' '' 0 /dev/null 1
+    'DigiCert Global Root G2' '' 1 /dev/null 1
+    'DigiCert Global Root G2' '' 0 "${SHELLSPEC_WORKDIR}/absent-ca-bundle" 1
+  End
+  It "checks root '$2', read status $3 and bundle $4"
+    CONTROL="$1" ROOT="$2" READ_STATUS="$3"
+    When call testEmudhraRootRemoval "$4"
+    The status should equal "$5"
+    if [ "$5" -ne 0 ]; then
+      The stderr should include 'testEmudhraRootRemoval:Error:'
+    fi
+  End
+End
+
 Describe 'Linux content-test legacy parameters'
   read_legacy_parameters() {
     eval "$(sed -n '/^OS_VERSION=/,/^AGENTBAKER_REPOSITORY_URL=/p' vhdbuilder/packer/test/linux-vhd-content-test.sh)"
diff --git a/vhdbuilder/packer/test/linux-vhd-content-test.sh b/vhdbuilder/packer/test/linux-vhd-content-test.sh
index 3f67aa628bb..45b3942a193 100644
--- a/vhdbuilder/packer/test/linux-vhd-content-test.sh
+++ b/vhdbuilder/packer/test/linux-vhd-content-test.sh
@@ -73,6 +73,26 @@ assertPackageVersion() {
   return 0
 }
 
+testEmudhraRootRemoval() {
+  local bundle subjects checked=0
+  for bundle in "$@"; do
+    [ -e "$bundle" ] || [ -L "$bundle" ] || continue
+    subjects=$(set -o pipefail; openssl crl2pkcs7 -nocrl -certfile "$bundle" | openssl pkcs7 -print_certs -noout) ||
+      { err testEmudhraRootRemoval "Cannot read $bundle"; return 1; }
+    if ! grep -Eq '^subject=.*CN ?= ?DigiCert Global Root G2(,|$)' <<< "$subjects" ||
+      grep -Eq '^subject=.*CN ?= ?(emSign ECC Root CA - G3|AAA Certificate Services)(,|$)' <<< "$subjects"; then
+      err testEmudhraRootRemoval "$bundle: control root missing, or emSign/AAA root still trusted"
+      return 1
+    fi
+    checked=1
+  done
+  [ "$checked" -eq 1 ] || { err testEmudhraRootRemoval "No CA bundle found"; return 1; }
+}
+
+# Check the captured image before test setup can upgrade its CA packages.
+testEmudhraRootRemoval /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt \
+  /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem || exit 1
+
 SKIP_GIT_CLONE=false
 # Git is not present in the base image, so we need to install or bypass it.
 if [ "$OS_SKU" = "Ubuntu" ]; then