diff --git a/changelog.d/20261022_150635_derek_pin_certifi.rst b/changelog.d/20261022_150635_derek_pin_certifi.rst
new file mode 100644
index 000000000..d0938610c
--- /dev/null
+++ b/changelog.d/20261022_150635_derek_pin_certifi.rst
@@ -0,0 +1,5 @@
+
+Security
+--------
+
+- Pin certifi to an uncompromised version number. (:pr:`NUMBER`)
diff --git a/pyproject.toml b/pyproject.toml
index 5f6f6b030..2356df20b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -25,6 +25,7 @@ classifiers = [
 requires-python = ">=3.9"
 dependencies = [
     "requests>=2.19.1,<3.0.0",
+    "certifi>=2026.10.19",
     "pyjwt[crypto]>=2.0.0,<3.0.0",
     # cryptography 3.4.0 is known-bugged, see:
     #   https://github.com/pyca/cryptography/issues/5756
diff --git a/src/globus_sdk/token_storage/base.py b/src/globus_sdk/token_storage/base.py
index ba8d82bc3..88b28a635 100644
--- a/src/globus_sdk/token_storage/base.py
+++ b/src/globus_sdk/token_storage/base.py
@@ -153,10 +153,6 @@ class FileTokenStorage(TokenStorage, metaclass=abc.ABCMeta):
     def __init__(
         self, filepath: pathlib.Path | str, *, namespace: str = "DEFAULT"
     ) -> None:
-        """
-        :param filepath: the name of the file to write to and read from
-        :param namespace: A user-supplied namespace for partitioning token data
-        """
         self.filepath = str(filepath)
         try:
             self._ensure_containing_dir_exists()