MongoDB CA_CERT environment variable not being evaluated

I have an app spec that defines a database and a service, and the service defines two environment variables, DATABASE_URL and CA_CERT, that it expects to be supplied by the database:

name: grocery-list
region: sfo

databases:
- cluster_name: my-cluster-name
  engine: MONGODB
  name: db
  production: true

services:
- build_command: npm install && npm run build
  envs:
  - key: DATABASE_URL
    scope: RUN_TIME
    value: ${db.DATABASE_URL}
  - key: CA_CERT
    scope: RUN_TIME
    value: ${db.CA_CERT}
  github:
    branch: main
    deploy_on_push: true
    repo: my-org/my-repo
  http_port: 8000
  instance_count: 1
  instance_size_slug: basic-xxs
  name: backend
  routes:
  - path: /api
    preserve_path_prefix: true
  run_command: npm start
  source_dir: /backend

However, when I start the app, only DATABASE_URL seems to be getting evaluated. Here’s a snippet from the Console tab of my running backend service:

apps@backend-7cfd7d7588-4xj9z:~/backend$ env

HOSTNAME=backend-7cfd7d7588-4xj9z
...
DATABASE_URL=mongodb+srv://doapps-[redacted]:[redacted]@cluster-[redacted].mongo.ondigitalocean.com/admin?authSource=admin&tls=true
CA_CERT=${db.CA_CERT}
...

What am I doing wrong, here? Why isn’t ${db.CA_CERT} being provided as the docs say it should be?