diff --git a/runners/flink/job-server-container/Dockerfile b/runners/flink/job-server-container/Dockerfile
index cbb73512400e..01c85b043612 100644
--- a/runners/flink/job-server-container/Dockerfile
+++ b/runners/flink/job-server-container/Dockerfile
@@ -19,7 +19,13 @@
 FROM eclipse-temurin:11
 MAINTAINER "Apache Beam <dev@beam.apache.org>"
 
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libltdl7
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libltdl7 \
+    && (keytool -list -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit \
+      | grep -iE "emsign|emudhra" \
+      | awk -F', ' '{print $1}' \
+      | while IFS= read -r alias; do \
+          keytool -delete -noprompt -alias "${alias}" -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit; \
+        done)
 
 ADD beam-runners-flink-job-server.jar /opt/apache/beam/jars/
 ADD flink-job-server.sh /opt/apache/beam/
diff --git a/runners/spark/job-server/container/Dockerfile b/runners/spark/job-server/container/Dockerfile
index f5639430a33b..8c2886476ea8 100644
--- a/runners/spark/job-server/container/Dockerfile
+++ b/runners/spark/job-server/container/Dockerfile
@@ -19,7 +19,13 @@
 FROM eclipse-temurin:11
 MAINTAINER "Apache Beam <dev@beam.apache.org>"
 
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libltdl7
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libltdl7 \
+    && (keytool -list -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit \
+      | grep -iE "emsign|emudhra" \
+      | awk -F', ' '{print $1}' \
+      | while IFS= read -r alias; do \
+          keytool -delete -noprompt -alias "${alias}" -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit; \
+        done)
 
 ADD beam-runners-spark-job-server.jar /opt/apache/beam/jars/
 ADD spark-job-server.sh /opt/apache/beam/
diff --git a/sdks/go/container/Dockerfile b/sdks/go/container/Dockerfile
index 3d70e2834b70..085496677277 100644
--- a/sdks/go/container/Dockerfile
+++ b/sdks/go/container/Dockerfile
@@ -16,7 +16,7 @@
 # limitations under the License.
 ###############################################################################
 
-FROM gcr.io/distroless/base-nossl-debian12:latest AS base_image
+FROM gcr.io/distroless/base-nossl-debian13:latest AS base_image
 
 # Distroless base image has many layers. Squash into single layer
 FROM scratch
diff --git a/sdks/java/container/Dockerfile b/sdks/java/container/Dockerfile
index 7a8c9e7e7d7e..bcfc41eed720 100644
--- a/sdks/java/container/Dockerfile
+++ b/sdks/java/container/Dockerfile
@@ -57,4 +57,14 @@ RUN if [ "${pull_licenses}" = "false" ] ; then \
 # Add Google Cloud Profiler agent.
 COPY target/profiler/* /opt/google_cloud_profiler/
 
+# Remove distrusted eMudhra / emSign root CA certificates from the JDK truststore.
+RUN CACERTS="${JAVA_HOME}/lib/security/cacerts"; \
+    if [ ! -f "${CACERTS}" ]; then CACERTS="${JAVA_HOME}/jre/lib/security/cacerts"; fi; \
+    keytool -list -keystore "${CACERTS}" -storepass changeit \
+      | grep -iE "emsign|emudhra" \
+      | awk -F', ' '{print $1}' \
+      | while IFS= read -r alias; do \
+          keytool -delete -noprompt -alias "${alias}" -keystore "${CACERTS}" -storepass changeit; \
+        done
+
 ENTRYPOINT ["/opt/apache/beam/boot"]
diff --git a/sdks/java/container/distroless/Dockerfile b/sdks/java/container/distroless/Dockerfile
index 328c4dc6a7b3..ad1a1b9c76de 100644
--- a/sdks/java/container/distroless/Dockerfile
+++ b/sdks/java/container/distroless/Dockerfile
@@ -34,6 +34,7 @@ RUN if [ -z "${TARGETARCH}" ]; then echo "fatal: TARGETARCH not set; run as dock
 FROM ${DISTROLESS_BASE}:latest-${TARGETARCH} AS distroless
 
 COPY --from=base /opt /opt
+COPY --from=base /opt/java/openjdk/lib/security/cacerts /etc/ssl/certs/java/cacerts
 
 # Along with the LANG environment variable above, prevents internally discovered failing bugs related to Dataflow Flex
 # template character encodings.
diff --git a/sdks/java/container/distroless/common.gradle b/sdks/java/container/distroless/common.gradle
index 7327a7291390..608a6b5e54eb 100644
--- a/sdks/java/container/distroless/common.gradle
+++ b/sdks/java/container/distroless/common.gradle
@@ -60,7 +60,7 @@ docker {
     files "./build/"
     buildArgs([
             'BEAM_BASE': base,
-            'DISTROLESS_BASE': "gcr.io/distroless/java${imageJavaVersion}-debian12"
+            'DISTROLESS_BASE': "gcr.io/distroless/java${imageJavaVersion}-debian13"
     ])
     buildx project.useBuildx()
     platform(*project.containerPlatforms())
diff --git a/sdks/java/expansion-service/container/Dockerfile b/sdks/java/expansion-service/container/Dockerfile
index 513dd6b75b88..a39269cd9511 100644
--- a/sdks/java/expansion-service/container/Dockerfile
+++ b/sdks/java/expansion-service/container/Dockerfile
@@ -47,4 +47,12 @@ RUN if [ "${pull_licenses}" = "false" ] ; then \
     rm -rf /opt/apache/beam/third_party_licenses ; \
    fi
 
+# Remove distrusted eMudhra / emSign root CA certificates from the JDK truststore.
+RUN keytool -list -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit \
+      | grep -iE "emsign|emudhra" \
+      | awk -F', ' '{print $1}' \
+      | while IFS= read -r alias; do \
+          keytool -delete -noprompt -alias "${alias}" -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit; \
+        done
+
 ENTRYPOINT ["/opt/apache/beam/boot", "-config_file", "./expansion_service_config.yml", "-dependencies_dir", "jars/"]
diff --git a/sdks/java/transform-service/controller-container/Dockerfile b/sdks/java/transform-service/controller-container/Dockerfile
index 4efa7bdc42c3..ccb26b37b002 100644
--- a/sdks/java/transform-service/controller-container/Dockerfile
+++ b/sdks/java/transform-service/controller-container/Dockerfile
@@ -43,4 +43,12 @@ RUN if [ "${pull_licenses}" = "false" ] ; then \
     rm -rf /opt/apache/beam/third_party_licenses ; \
    fi
 
+# Remove distrusted eMudhra / emSign root CA certificates from the JDK truststore.
+RUN keytool -list -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit \
+      | grep -iE "emsign|emudhra" \
+      | awk -F', ' '{print $1}' \
+      | while IFS= read -r alias; do \
+          keytool -delete -noprompt -alias "${alias}" -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit; \
+        done
+
 ENTRYPOINT ["./boot", "-config_file", "./transform_service_config.yml"]
diff --git a/sdks/python/container/distroless/Dockerfile b/sdks/python/container/distroless/Dockerfile
index 2799bd2be81f..287c64fd9d86 100644
--- a/sdks/python/container/distroless/Dockerfile
+++ b/sdks/python/container/distroless/Dockerfile
@@ -24,7 +24,7 @@ LABEL Author="Apache Beam <dev@beam.apache.org>"
 
 RUN if [ -z "${TARGETARCH}" ]; then echo "fatal: TARGETARCH not set; run as docker buildx build or use --build-arg=TARGETARCH=amd64|arm64" >&2; exit 1; fi
 
-FROM gcr.io/distroless/python3-debian12:latest-${TARGETARCH} AS distroless
+FROM gcr.io/distroless/python3-debian13:latest-${TARGETARCH} AS distroless
 
 # Prevents internal errors found with distroless container images and Flex templates.
 COPY --from=base /usr/lib/locale /usr/lib/locale
diff --git a/sdks/python/container/ml/py310/base_image_requirements.txt b/sdks/python/container/ml/py310/base_image_requirements.txt
index d075e695cfb0..9b149a59a12b 100644
--- a/sdks/python/container/ml/py310/base_image_requirements.txt
+++ b/sdks/python/container/ml/py310/base_image_requirements.txt
@@ -37,7 +37,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -96,8 +96,8 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
@@ -105,7 +105,7 @@ h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 huggingface_hub==0.36.2
 hyperframe==6.1.0
diff --git a/sdks/python/container/ml/py310/gpu_image_requirements.txt b/sdks/python/container/ml/py310/gpu_image_requirements.txt
index 77013a36eb82..cc09fd7ab598 100644
--- a/sdks/python/container/ml/py310/gpu_image_requirements.txt
+++ b/sdks/python/container/ml/py310/gpu_image_requirements.txt
@@ -41,7 +41,7 @@ bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
 cbor2==6.1.4
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -116,8 +116,8 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
@@ -125,7 +125,7 @@ h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httptools==0.8.0
 httpx==0.28.1
 huggingface_hub==0.36.2
diff --git a/sdks/python/container/ml/py311/base_image_requirements.txt b/sdks/python/container/ml/py311/base_image_requirements.txt
index 4f8f6e7dcf03..010b3ba44d7f 100644
--- a/sdks/python/container/ml/py311/base_image_requirements.txt
+++ b/sdks/python/container/ml/py311/base_image_requirements.txt
@@ -36,7 +36,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -94,8 +94,8 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
@@ -103,7 +103,7 @@ h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 huggingface_hub==0.36.2
 hyperframe==6.1.0
diff --git a/sdks/python/container/ml/py311/gpu_image_requirements.txt b/sdks/python/container/ml/py311/gpu_image_requirements.txt
index 1717a25be2cc..87958fddfa36 100644
--- a/sdks/python/container/ml/py311/gpu_image_requirements.txt
+++ b/sdks/python/container/ml/py311/gpu_image_requirements.txt
@@ -40,7 +40,7 @@ bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
 cbor2==6.1.4
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -114,8 +114,8 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
@@ -123,7 +123,7 @@ h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httptools==0.8.0
 httpx==0.28.1
 huggingface_hub==0.36.2
diff --git a/sdks/python/container/ml/py312/base_image_requirements.txt b/sdks/python/container/ml/py312/base_image_requirements.txt
index 7c245afc020f..fa95716946e5 100644
--- a/sdks/python/container/ml/py312/base_image_requirements.txt
+++ b/sdks/python/container/ml/py312/base_image_requirements.txt
@@ -35,7 +35,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -93,8 +93,8 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
@@ -102,7 +102,7 @@ h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 huggingface_hub==0.36.2
 hyperframe==6.1.0
diff --git a/sdks/python/container/ml/py312/gpu_image_requirements.txt b/sdks/python/container/ml/py312/gpu_image_requirements.txt
index dd5458171e97..20bd5cfc739a 100644
--- a/sdks/python/container/ml/py312/gpu_image_requirements.txt
+++ b/sdks/python/container/ml/py312/gpu_image_requirements.txt
@@ -39,7 +39,7 @@ bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
 cbor2==6.1.4
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -113,8 +113,8 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
@@ -122,7 +122,7 @@ h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httptools==0.8.0
 httpx==0.28.1
 huggingface_hub==0.36.2
diff --git a/sdks/python/container/ml/py313/base_image_requirements.txt b/sdks/python/container/ml/py313/base_image_requirements.txt
index e6cc9b8b11f4..3ac48c12dd9c 100644
--- a/sdks/python/container/ml/py313/base_image_requirements.txt
+++ b/sdks/python/container/ml/py313/base_image_requirements.txt
@@ -35,7 +35,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -92,8 +92,8 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
@@ -101,7 +101,7 @@ h5py==3.14.0
 hf-xet==1.6.0
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 huggingface_hub==0.36.2
 hyperframe==6.1.0
diff --git a/sdks/python/container/py310/base_image_requirements.txt b/sdks/python/container/py310/base_image_requirements.txt
index 62b8ef00dc99..e1ac27a882b8 100644
--- a/sdks/python/container/py310/base_image_requirements.txt
+++ b/sdks/python/container/py310/base_image_requirements.txt
@@ -35,7 +35,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -89,14 +89,14 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 hyperframe==6.1.0
 hypothesis==6.148.3
diff --git a/sdks/python/container/py311/base_image_requirements.txt b/sdks/python/container/py311/base_image_requirements.txt
index cc2db12cb477..58fc4f459b95 100644
--- a/sdks/python/container/py311/base_image_requirements.txt
+++ b/sdks/python/container/py311/base_image_requirements.txt
@@ -34,7 +34,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -87,14 +87,14 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 hyperframe==6.1.0
 hypothesis==6.148.3
diff --git a/sdks/python/container/py312/base_image_requirements.txt b/sdks/python/container/py312/base_image_requirements.txt
index 767858f342fd..24b4baca945f 100644
--- a/sdks/python/container/py312/base_image_requirements.txt
+++ b/sdks/python/container/py312/base_image_requirements.txt
@@ -33,7 +33,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -86,14 +86,14 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 hyperframe==6.1.0
 hypothesis==6.148.3
diff --git a/sdks/python/container/py313/base_image_requirements.txt b/sdks/python/container/py313/base_image_requirements.txt
index 34a40461670e..d04061d7dd48 100644
--- a/sdks/python/container/py313/base_image_requirements.txt
+++ b/sdks/python/container/py313/base_image_requirements.txt
@@ -33,7 +33,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -85,14 +85,14 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 hyperframe==6.1.0
 hypothesis==6.148.3
diff --git a/sdks/python/container/py314/base_image_requirements.txt b/sdks/python/container/py314/base_image_requirements.txt
index 95a61155cbbb..c54035585ab3 100644
--- a/sdks/python/container/py314/base_image_requirements.txt
+++ b/sdks/python/container/py314/base_image_requirements.txt
@@ -33,7 +33,7 @@ beautifulsoup4==4.15.0
 bs4==0.0.2
 build==1.5.0
 cachetools==6.2.6
-certifi==2026.10.19
+certifi==2026.10.23
 cffi==2.1.1
 charset-normalizer==3.5.0
 click==8.4.2
@@ -85,14 +85,14 @@ googleapis-common-protos==1.75.1
 greenlet==3.5.5
 grpc-google-iam-v1==0.14.5
 grpc-interceptor==0.15.4
-grpcio==1.83.0
-grpcio-status==1.83.0
+grpcio==1.85.0
+grpcio-status==1.85.0
 guppy3==3.1.7
 h11==0.16.0
 h2==4.4.1
 hpack==4.2.0
 httpcore==1.0.9
-httplib2==0.32.0
+httplib2==0.32.1
 httpx==0.28.1
 hyperframe==6.1.0
 hypothesis==6.148.3