diff --git a/pyproject.toml b/pyproject.toml
index 511228c..c4a5aef 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -22,6 +22,8 @@ keywords = ["Kaggle", "API"]
 requires-python = ">=3.11"
 dependencies = [
   "requests",
+  # Pulled in by requests; floor drops the compromised emSign CA (GHSA-6q48-6c7w-9gw2).
+  "certifi>=2026.10.19",
   "protobuf",
 ]
 
diff --git a/tools/cicd/Dockerfile b/tools/cicd/Dockerfile
index 5efe0dd7..2d1ec0f 100644
--- a/tools/cicd/Dockerfile
+++ b/tools/cicd/Dockerfile
@@ -4,8 +4,12 @@ ARG PYTHON_VERSION
 
 FROM python:${PYTHON_VERSION}
 
-RUN python -m pip install --upgrade pip
+# Pick up the latest OS trust store (emSign/eMudhra CA removal,
+# GHSA-6q48-6c7w-9gw2).
+RUN apt-get update \
+    && apt-get install -y --only-upgrade ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 
-RUN python -m pip install build==1.3.0 twine==6.2.0
+RUN python -m pip install --upgrade "pip>=26.2.2" "certifi>=2026.10.19" build==1.3.0 twine==6.2.0
 
 ENTRYPOINT ["python3"]
\ No newline at end of file