diff --git a/changelog.d/20261022_151229_derek_pin_3_x_certifi.rst b/changelog.d/20261022_151229_derek_pin_3_x_certifi.rst
new file mode 100644
index 000000000..d0938610c
--- /dev/null
+++ b/changelog.d/20261022_151229_derek_pin_3_x_certifi.rst
@@ -0,0 +1,5 @@
+
+Security
+--------
+
+- Pin certifi to an uncompromised version number. (:pr:`NUMBER`)
diff --git a/pyproject.toml b/pyproject.toml
index fec83d7ce..1d795c0fd 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -24,6 +24,7 @@ classifiers = [
 requires-python = ">=3.8"
 dependencies = [
     "requests>=2.19.1,<3.0.0",
+    "certifi>=2026.10.19",
     "pyjwt[crypto]>=2.0.0,<3.0.0",
     # cryptography 3.4.0 is known-bugged, see:
     #   https://github.com/pyca/cryptography/issues/5756