diff --git a/CHANGELOG.md b/CHANGELOG.md
index fd402a6..5cea0c4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ and this project adheres to a _modified_ form of _[Semantic Versioning][semver]_
 
 ### Fixed
 
+- Require `certifi>=2026.10.19` so installs drop the compromised eMudhra `emSign ECC Root CA - G3` root.
+
 ### Removed
 
 ## [0.9.4]
diff --git a/pyproject.toml b/pyproject.toml
index 1c0a01c..b194253 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -35,6 +35,7 @@ classifiers = [
 dependencies = [
   "lxml>=4.9",
   "requests==2.*",
+  "certifi>=2026.10.19",
   "packaging>=24.1",
 ]
 dynamic = ["version"]