diff --git a/python/pyproject.toml b/python/pyproject.toml
index 38ea392..103b133 100644
--- a/python/pyproject.toml
+++ b/python/pyproject.toml
@@ -55,6 +55,8 @@ data = [
 # For HTTP clients, prefer httpx over requests
 http = [
     "httpx>=0.28.0",
+    # security pin CVE-2026-111943 (eMudhra); transitive via httpx
+    "certifi>=2026.10.19",
 ]
 # For data validation, use pydantic 2
 validation = [
diff --git a/python/uv.lock b/python/uv.lock
index f44f65b..e48fa26 100644
--- a/python/uv.lock
+++ b/python/uv.lock
@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 5
 requires-python = ">=3.11"
 
 [[package]]
@@ -39,11 +39,11 @@ wheels = [
 
 [[package]]
 name = "certifi"
-version = "2026.7.22"
+version = "2026.10.19"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" },
 ]
 
 [[package]]
@@ -482,6 +482,7 @@ dev = [
     { name = "ruff" },
 ]
 http = [
+    { name = "certifi" },
     { name = "httpx" },
 ]
 lint = [
@@ -505,6 +506,7 @@ dev = [
 [package.metadata]
 requires-dist = [
     { name = "aws-lambda-powertools", marker = "extra == 'aws-lambda'", specifier = ">=3.34.0" },
+    { name = "certifi", marker = "extra == 'http'", specifier = ">=2026.10.19" },
     { name = "httpx", marker = "extra == 'http'", specifier = ">=0.28.0" },
     { name = "polars", marker = "extra == 'data'", specifier = ">=1.44.0" },
     { name = "pydantic", marker = "extra == 'validation'", specifier = ">=2.13.0" },