From 4fec58f2576fb8d06c6f60551debfe0032f1e316 Mon Sep 17 00:00:00 2001
From: Bilal Mahmoud <7252775+indietyp@users.noreply.github.com>
Date: Tue, 20 Oct 2026 21:54:56 +0200
Subject: [PATCH 1/6] fix: distrust compromised root CAs in containers

---
 apps/brunch-agent/docker/Dockerfile            |  8 ++++++++
 apps/hash-ai-worker-ts/docker/Dockerfile       |  8 ++++++++
 apps/hash-ai-worker-ts/package.json            |  2 +-
 apps/hash-api/docker/Dockerfile                |  8 ++++++++
 apps/hash-api/package.json                     |  2 +-
 apps/hash-frontend/docker/Dockerfile           |  8 ++++++++
 apps/hash-graph/docker/Dockerfile              |  6 ++++++
 apps/hash-integration-worker/docker/Dockerfile |  8 ++++++++
 apps/hash-integration-worker/package.json      |  2 +-
 apps/petrinaut-opt/docker/Dockerfile           |  7 +++++++
 infra/compose/hydra/Dockerfile                 |  4 ++++
 infra/compose/kratos/Dockerfile                | 14 ++++++++++++++
 libs/@local/graph/atlas/docker/Dockerfile      |  2 +-
 13 files changed, 75 insertions(+), 4 deletions(-)

diff --git a/apps/brunch-agent/docker/Dockerfile b/apps/brunch-agent/docker/Dockerfile
index f20220846d4..5cd579f563c 100644
--- a/apps/brunch-agent/docker/Dockerfile
+++ b/apps/brunch-agent/docker/Dockerfile
@@ -13,9 +13,15 @@ ENV PATH="/mise/shims:$PATH"
 
 COPY .config/mise /etc/mise
 
+# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends ca-certificates curl && \
+    sed -i \
+    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
+    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
+    /etc/ca-certificates.conf && \
+    update-ca-certificates && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \
@@ -93,6 +99,8 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
 FROM mise AS runner
 
 ENV NODE_ENV=production
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
 ENV PORT=3002
 # RDS server certificates chain to Amazon's private CAs, which the system trust store does not carry.
 ENV BRUNCH_POSTGRES_TLS_CA_PATH=/etc/ssl/certs/rds-global-bundle.pem
diff --git a/apps/hash-ai-worker-ts/docker/Dockerfile b/apps/hash-ai-worker-ts/docker/Dockerfile
index 196c74ed273..fe10eb920e5 100644
--- a/apps/hash-ai-worker-ts/docker/Dockerfile
+++ b/apps/hash-ai-worker-ts/docker/Dockerfile
@@ -10,9 +10,15 @@ ENV PATH="/mise/shims:$PATH"
 
 COPY .config/mise /etc/mise
 
+# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
+    sed -i \
+    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
+    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
+    /etc/ca-certificates.conf && \
+    update-ca-certificates && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \
@@ -100,6 +106,8 @@ RUN GITHUB_TOKEN="" mise install --locked node && \
 
 USER tsworker:hash
 ENV NODE_ENV=production
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
 
 ENTRYPOINT [ "yarn"]
 CMD ["start"]
diff --git a/apps/hash-ai-worker-ts/package.json b/apps/hash-ai-worker-ts/package.json
index f34ac7b4d33..370b64fa3cd 100644
--- a/apps/hash-ai-worker-ts/package.json
+++ b/apps/hash-ai-worker-ts/package.json
@@ -36,7 +36,7 @@
     "run-flow-scenario": "NODE_ENV=development yarn exe ./scripts/flow-scenarios/run-flow-scenario.ts",
     "sanitize-html": "NODE_ENV=development yarn exe ./scripts/sanitize-html.ts",
     "sentry:sourcemaps": "sentry-cli sourcemaps inject --org hashintel --project hash-temporal-worker-ai ./dist && sentry-cli sourcemaps upload --org hashintel --project hash-temporal-worker-ai ./dist",
-    "start": "NODE_ENV=production NODE_OPTIONS=--max-old-space-size=2048 node ./dist/main.js",
+    "start": "NODE_ENV=production NODE_OPTIONS=\"${NODE_OPTIONS:-} --max-old-space-size=2048\" node ./dist/main.js",
     "start:healthcheck": "wait-on --timeout 1200000 http-get://localhost:4100/health",
     "start:test": "NODE_ENV=test NODE_OPTIONS=--max-old-space-size=2048 node ./dist/main.js",
     "start:test:healthcheck": "wait-on --timeout 600000 http-get://localhost:4100/health",
diff --git a/apps/hash-api/docker/Dockerfile b/apps/hash-api/docker/Dockerfile
index 0fd978ae4fb..db349c3aa6f 100644
--- a/apps/hash-api/docker/Dockerfile
+++ b/apps/hash-api/docker/Dockerfile
@@ -10,9 +10,15 @@ ENV PATH="/mise/shims:$PATH"
 
 COPY .config/mise /etc/mise
 
+# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
+    sed -i \
+    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
+    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
+    /etc/ca-certificates.conf && \
+    update-ca-certificates && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \
@@ -99,6 +105,8 @@ RUN groupadd --system --gid 60000 hash && \
 
 USER api:hash
 ENV NODE_ENV=production
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
 
 ENTRYPOINT [ "yarn"]
 CMD ["start"]
diff --git a/apps/hash-api/package.json b/apps/hash-api/package.json
index 12f29881ac2..6d88e4c9cfb 100644
--- a/apps/hash-api/package.json
+++ b/apps/hash-api/package.json
@@ -19,7 +19,7 @@
     "lint:eslint": "eslint --report-unused-disable-directives .",
     "lint:tsc": "tsc --noEmit",
     "setup:admin": "NODE_ENV=production OTEL_SERVICE_NAME=\"Setup Admin\" tsx --import ./src/instrument.mjs ./src/setup-admin.ts",
-    "start": "NODE_ENV=production NODE_OPTIONS=--max-old-space-size=2048 tsx --import ./src/instrument.mjs ./src/index.ts",
+    "start": "NODE_ENV=production NODE_OPTIONS=\"${NODE_OPTIONS:-} --max-old-space-size=2048\" tsx --import ./src/instrument.mjs ./src/index.ts",
     "start:healthcheck": "wait-on --timeout 1200000 http://localhost:5001",
     "start:migrate": "NODE_ENV=production OTEL_SERVICE_NAME=\"Node Migrations\" tsx --import ./src/instrument.mjs ./src/ensure-system-graph-is-initialized.ts",
     "start:test": "NODE_ENV=test NODE_OPTIONS=--max-old-space-size=2048 tsx ./src/index.ts",
diff --git a/apps/hash-frontend/docker/Dockerfile b/apps/hash-frontend/docker/Dockerfile
index 3c2484cf98d..8c751677ea4 100644
--- a/apps/hash-frontend/docker/Dockerfile
+++ b/apps/hash-frontend/docker/Dockerfile
@@ -8,9 +8,15 @@ ENV PATH="/mise/shims:$PATH"
 
 COPY .config/mise /etc/mise
 
+# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
+    sed -i \
+    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
+    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
+    /etc/ca-certificates.conf && \
+    update-ca-certificates && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \
@@ -104,6 +110,8 @@ RUN groupadd --system --gid 60000 hash && \
 
 USER frontend:hash
 ENV NODE_ENV=production
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
 ENV YARN_CACHE_FOLDER=/tmp/yarn-cache
 ENV YARN_GLOBAL_FOLDER=/tmp/yarn-global
 
diff --git a/apps/hash-graph/docker/Dockerfile b/apps/hash-graph/docker/Dockerfile
index ec88102295f..6b65284d3a4 100644
--- a/apps/hash-graph/docker/Dockerfile
+++ b/apps/hash-graph/docker/Dockerfile
@@ -11,9 +11,15 @@ ENV PATH="/mise/shims:$PATH"
 
 COPY .config/mise /etc/mise
 
+# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413. The runner copies this bundle.
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
+    sed -i \
+    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
+    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
+    /etc/ca-certificates.conf && \
+    update-ca-certificates && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \
diff --git a/apps/hash-integration-worker/docker/Dockerfile b/apps/hash-integration-worker/docker/Dockerfile
index ba57fa2eac0..838ff34449e 100644
--- a/apps/hash-integration-worker/docker/Dockerfile
+++ b/apps/hash-integration-worker/docker/Dockerfile
@@ -10,9 +10,15 @@ ENV PATH="/mise/shims:$PATH"
 
 COPY .config/mise /etc/mise
 
+# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
+    sed -i \
+    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
+    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
+    /etc/ca-certificates.conf && \
+    update-ca-certificates && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \
@@ -100,6 +106,8 @@ RUN groupadd --system --gid 60000 hash && \
 
 USER integrationworker:hash
 ENV NODE_ENV=production
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
 
 ENTRYPOINT [ "yarn"]
 CMD ["start"]
diff --git a/apps/hash-integration-worker/package.json b/apps/hash-integration-worker/package.json
index 77598ef5952..eae0e0187aa 100644
--- a/apps/hash-integration-worker/package.json
+++ b/apps/hash-integration-worker/package.json
@@ -14,7 +14,7 @@
     "lint:eslint": "eslint --report-unused-disable-directives .",
     "lint:tsc": "tsc --noEmit",
     "sentry:sourcemaps": "sentry-cli sourcemaps inject --org hashintel --project hash-temporal-worker-integration ./dist && sentry-cli sourcemaps upload --org hashintel --project hash-temporal-worker-integration ./dist",
-    "start": "NODE_ENV=production NODE_OPTIONS=--max-old-space-size=2048 tsx ./src/main.ts",
+    "start": "NODE_ENV=production NODE_OPTIONS=\"${NODE_OPTIONS:-} --max-old-space-size=2048\" tsx ./src/main.ts",
     "start:healthcheck": "wait-on --timeout 1200000 http-get://localhost:4300/health",
     "start:test": "NODE_ENV=test NODE_OPTIONS=--max-old-space-size=2048 tsx ./dist/main.js",
     "start:test:healthcheck": "wait-on --timeout 600000 http-get://localhost:4300/health"
diff --git a/apps/petrinaut-opt/docker/Dockerfile b/apps/petrinaut-opt/docker/Dockerfile
index 4b1c14d05a2..98dde0ed353 100644
--- a/apps/petrinaut-opt/docker/Dockerfile
+++ b/apps/petrinaut-opt/docker/Dockerfile
@@ -125,6 +125,13 @@ COPY apps/petrinaut-opt/src ./src
 # built workspace packages it resolves.
 COPY --from=bindings-runtime / /opt/petrinaut-runtime
 
+# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
+RUN sed -i \
+    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
+    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
+    /etc/ca-certificates.conf && \
+    update-ca-certificates
+
 # `petrinaut` is the command the bindings spawn by default, and they give the
 # child a fixed PATH of /usr/local/bin:/usr/bin:/bin, so it is linked there.
 RUN chmod +x /opt/petrinaut-runtime/node_modules/.bin/petrinaut && \
diff --git a/infra/compose/hydra/Dockerfile b/infra/compose/hydra/Dockerfile
index 0808891b64f..208cd86d176 100644
--- a/infra/compose/hydra/Dockerfile
+++ b/infra/compose/hydra/Dockerfile
@@ -2,6 +2,10 @@ FROM oryd/hydra:v25.4
 
 USER root
 
+# Distrust until updated base image removes compromised intermediate CAs, see: https://emudhra.we-have-a-problem.com/
+RUN sed -i -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' /etc/ca-certificates.conf && \
+    update-ca-certificates
+
 RUN mkdir -p /home/nonroot/.postgresql
 
 # Add AWS certificate bundle for SSL connection
diff --git a/infra/compose/kratos/Dockerfile b/infra/compose/kratos/Dockerfile
index 9bcd7cf4c0e..0a45e97c5ec 100644
--- a/infra/compose/kratos/Dockerfile
+++ b/infra/compose/kratos/Dockerfile
@@ -1,5 +1,19 @@
+# Distrust until updated base image removes compromised intermediate CAs, see: https://emudhra.we-have-a-problem.com/
+FROM debian:13.3-slim AS ca-certificates
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates && \
+    sed -i \
+    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
+    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
+    /etc/ca-certificates.conf && \
+    update-ca-certificates
+
+
 FROM oryd/kratos:v26.2.0-distroless
 
+COPY --from=ca-certificates /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
 COPY ./templates /etc/config/kratos/templates
 COPY ./hooks /etc/config/kratos/hooks
 COPY ./identity.schema.json /etc/config/kratos/
diff --git a/libs/@local/graph/atlas/docker/Dockerfile b/libs/@local/graph/atlas/docker/Dockerfile
index 9facef6ac0e..6c4e77e68e2 100644
--- a/libs/@local/graph/atlas/docker/Dockerfile
+++ b/libs/@local/graph/atlas/docker/Dockerfile
@@ -107,7 +107,7 @@ RUN cuda="${CUDA_VERSION%.*}" && \
     cuda="${cuda/./-}" && \
     apt-get update && \
     apt-get install -y --no-install-recommends \
-    "cuda-nvrtc-${cuda}" "cuda-cudart-dev-${cuda}" "cuda-cccl-${cuda}" && \
+    "cuda-nvrtc-${cuda}" "cuda-cudart-dev-${cuda}" "cuda-cccl-${cuda}" ca-certificates && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
     ldconfig && \

From de8c0cc3f3a64042a160cfe4cb2364cad5f36ecc Mon Sep 17 00:00:00 2001
From: Bilal Mahmoud <7252775+indietyp@users.noreply.github.com>
Date: Tue, 20 Oct 2026 23:18:53 +0200
Subject: [PATCH 2/6] chore: standardize container certificate trust

---
 apps/brunch-agent/docker/Dockerfile            |  5 +++--
 apps/hash-ai-worker-ts/docker/Dockerfile       |  5 +++--
 apps/hash-api/docker/Dockerfile                |  5 +++--
 apps/hash-frontend/docker/Dockerfile           |  5 +++--
 apps/hash-graph/docker/Dockerfile              |  3 +++
 apps/hash-integration-worker/docker/Dockerfile |  5 +++--
 apps/petrinaut-opt/docker/Dockerfile           | 11 +++++++++++
 libs/@local/graph/atlas/docker/Dockerfile      |  8 ++++++++
 8 files changed, 37 insertions(+), 10 deletions(-)

diff --git a/apps/brunch-agent/docker/Dockerfile b/apps/brunch-agent/docker/Dockerfile
index 5cd579f563c..7a1e6886a62 100644
--- a/apps/brunch-agent/docker/Dockerfile
+++ b/apps/brunch-agent/docker/Dockerfile
@@ -11,6 +11,9 @@ ENV MISE_DATA_DIR="/mise"
 ENV MISE_CACHE_DIR="/mise/cache"
 ENV PATH="/mise/shims:$PATH"
 
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
+
 COPY .config/mise /etc/mise
 
 # Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
@@ -99,8 +102,6 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
 FROM mise AS runner
 
 ENV NODE_ENV=production
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
-ENV NODE_OPTIONS=--use-openssl-ca
 ENV PORT=3002
 # RDS server certificates chain to Amazon's private CAs, which the system trust store does not carry.
 ENV BRUNCH_POSTGRES_TLS_CA_PATH=/etc/ssl/certs/rds-global-bundle.pem
diff --git a/apps/hash-ai-worker-ts/docker/Dockerfile b/apps/hash-ai-worker-ts/docker/Dockerfile
index fe10eb920e5..5988e4e00aa 100644
--- a/apps/hash-ai-worker-ts/docker/Dockerfile
+++ b/apps/hash-ai-worker-ts/docker/Dockerfile
@@ -8,6 +8,9 @@ ENV MISE_DATA_DIR="/mise"
 ENV MISE_CACHE_DIR="/mise/cache"
 ENV PATH="/mise/shims:$PATH"
 
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
+
 COPY .config/mise /etc/mise
 
 # Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
@@ -106,8 +109,6 @@ RUN GITHUB_TOKEN="" mise install --locked node && \
 
 USER tsworker:hash
 ENV NODE_ENV=production
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
-ENV NODE_OPTIONS=--use-openssl-ca
 
 ENTRYPOINT [ "yarn"]
 CMD ["start"]
diff --git a/apps/hash-api/docker/Dockerfile b/apps/hash-api/docker/Dockerfile
index db349c3aa6f..9e83c704234 100644
--- a/apps/hash-api/docker/Dockerfile
+++ b/apps/hash-api/docker/Dockerfile
@@ -8,6 +8,9 @@ ENV MISE_DATA_DIR="/mise"
 ENV MISE_CACHE_DIR="/mise/cache"
 ENV PATH="/mise/shims:$PATH"
 
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
+
 COPY .config/mise /etc/mise
 
 # Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
@@ -105,8 +108,6 @@ RUN groupadd --system --gid 60000 hash && \
 
 USER api:hash
 ENV NODE_ENV=production
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
-ENV NODE_OPTIONS=--use-openssl-ca
 
 ENTRYPOINT [ "yarn"]
 CMD ["start"]
diff --git a/apps/hash-frontend/docker/Dockerfile b/apps/hash-frontend/docker/Dockerfile
index 8c751677ea4..3ae1878fc7a 100644
--- a/apps/hash-frontend/docker/Dockerfile
+++ b/apps/hash-frontend/docker/Dockerfile
@@ -6,6 +6,9 @@ ENV MISE_DATA_DIR="/mise"
 ENV MISE_CACHE_DIR="/mise/cache"
 ENV PATH="/mise/shims:$PATH"
 
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
+
 COPY .config/mise /etc/mise
 
 # Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
@@ -110,8 +113,6 @@ RUN groupadd --system --gid 60000 hash && \
 
 USER frontend:hash
 ENV NODE_ENV=production
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
-ENV NODE_OPTIONS=--use-openssl-ca
 ENV YARN_CACHE_FOLDER=/tmp/yarn-cache
 ENV YARN_GLOBAL_FOLDER=/tmp/yarn-global
 
diff --git a/apps/hash-graph/docker/Dockerfile b/apps/hash-graph/docker/Dockerfile
index 6b65284d3a4..7e33a338aa4 100644
--- a/apps/hash-graph/docker/Dockerfile
+++ b/apps/hash-graph/docker/Dockerfile
@@ -9,6 +9,9 @@ ENV MISE_CACHE_DIR="/mise/cache"
 ENV MISE_NODE_COREPACK=1
 ENV PATH="/mise/shims:$PATH"
 
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
+
 COPY .config/mise /etc/mise
 
 # Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413. The runner copies this bundle.
diff --git a/apps/hash-integration-worker/docker/Dockerfile b/apps/hash-integration-worker/docker/Dockerfile
index 838ff34449e..917c18a7b02 100644
--- a/apps/hash-integration-worker/docker/Dockerfile
+++ b/apps/hash-integration-worker/docker/Dockerfile
@@ -8,6 +8,9 @@ ENV MISE_DATA_DIR="/mise"
 ENV MISE_CACHE_DIR="/mise/cache"
 ENV PATH="/mise/shims:$PATH"
 
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
+
 COPY .config/mise /etc/mise
 
 # Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
@@ -106,8 +109,6 @@ RUN groupadd --system --gid 60000 hash && \
 
 USER integrationworker:hash
 ENV NODE_ENV=production
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
-ENV NODE_OPTIONS=--use-openssl-ca
 
 ENTRYPOINT [ "yarn"]
 CMD ["start"]
diff --git a/apps/petrinaut-opt/docker/Dockerfile b/apps/petrinaut-opt/docker/Dockerfile
index 98dde0ed353..b63f779d8a8 100644
--- a/apps/petrinaut-opt/docker/Dockerfile
+++ b/apps/petrinaut-opt/docker/Dockerfile
@@ -17,6 +17,9 @@ ENV MISE_CACHE_DIR="/mise/cache"
 ENV MISE_CARGO_HOME="/usr/local/cargo"
 ENV PATH="/mise/shims:/usr/local/cargo/bin:$PATH"
 
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
+
 COPY .config/mise /etc/mise
 
 # turbo reads the Cargo workspace through `cargo metadata`, in the prune as well as in the build.
@@ -24,6 +27,11 @@ COPY rust-toolchain.toml /tmp/rust-toolchain.toml
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
+    sed -i \
+    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
+    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
+    /etc/ca-certificates.conf && \
+    update-ca-certificates && \
     /etc/mise/install.sh && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
@@ -113,6 +121,9 @@ ENV PATH="/opt/venv/bin:${PATH}" \
     PYTHONUNBUFFERED=1 \
     PETRINAUT_CHILD_NODE_OPTIONS="--permission --allow-fs-read=/opt/petrinaut-runtime --allow-fs-read=/usr/local/bin/petrinaut --disable-proto=throw --max-old-space-size=768 --no-addons --no-global-search-paths"
 
+# gRPC otherwise loads the roots bundled in grpcio.
+ENV GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/etc/ssl/certs/ca-certificates.crt
+
 WORKDIR /app
 
 # Node is what the bindings' executable runs on today.
diff --git a/libs/@local/graph/atlas/docker/Dockerfile b/libs/@local/graph/atlas/docker/Dockerfile
index 6c4e77e68e2..a02cdd4b1ce 100644
--- a/libs/@local/graph/atlas/docker/Dockerfile
+++ b/libs/@local/graph/atlas/docker/Dockerfile
@@ -12,11 +12,19 @@ ENV MISE_CACHE_DIR="/mise/cache"
 ENV MISE_NODE_COREPACK=1
 ENV PATH="/mise/shims:$PATH"
 
+# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+ENV NODE_OPTIONS=--use-openssl-ca
+
 COPY .config/mise /etc/mise
 
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
+    sed -i \
+    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
+    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
+    /etc/ca-certificates.conf && \
+    update-ca-certificates && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \

From 6bd0aff5d4872ee21890130a3a386c0a49133bdd Mon Sep 17 00:00:00 2001
From: Bilal Mahmoud <7252775+indietyp@users.noreply.github.com>
Date: Wed, 21 Oct 2026 00:54:32 +0200
Subject: [PATCH 3/6] chore: require updated CA certificates everywhere

---
 apps/brunch-agent/docker/Dockerfile            |  7 +------
 apps/hash-ai-worker-ts/docker/Dockerfile       |  7 +------
 apps/hash-api/docker/Dockerfile                |  7 +------
 apps/hash-frontend/docker/Dockerfile           |  7 +------
 apps/hash-graph/docker/Dockerfile              |  8 ++------
 apps/hash-integration-worker/docker/Dockerfile |  7 +------
 apps/petrinaut-opt/docker/Dockerfile           | 17 ++++++-----------
 infra/compose/hydra/Dockerfile                 |  4 +---
 infra/compose/kratos/Dockerfile                |  7 +------
 libs/@local/graph/atlas/docker/Dockerfile      |  6 +-----
 10 files changed, 16 insertions(+), 61 deletions(-)

diff --git a/apps/brunch-agent/docker/Dockerfile b/apps/brunch-agent/docker/Dockerfile
index 7a1e6886a62..63fc0a711d4 100644
--- a/apps/brunch-agent/docker/Dockerfile
+++ b/apps/brunch-agent/docker/Dockerfile
@@ -16,15 +16,10 @@ ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
 
-# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends ca-certificates curl && \
-    sed -i \
-    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
-    /etc/ca-certificates.conf && \
-    update-ca-certificates && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \
diff --git a/apps/hash-ai-worker-ts/docker/Dockerfile b/apps/hash-ai-worker-ts/docker/Dockerfile
index 5988e4e00aa..97bff1b96d3 100644
--- a/apps/hash-ai-worker-ts/docker/Dockerfile
+++ b/apps/hash-ai-worker-ts/docker/Dockerfile
@@ -13,15 +13,10 @@ ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
 
-# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    sed -i \
-    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
-    /etc/ca-certificates.conf && \
-    update-ca-certificates && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \
diff --git a/apps/hash-api/docker/Dockerfile b/apps/hash-api/docker/Dockerfile
index 9e83c704234..4437485cd97 100644
--- a/apps/hash-api/docker/Dockerfile
+++ b/apps/hash-api/docker/Dockerfile
@@ -13,15 +13,10 @@ ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
 
-# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    sed -i \
-    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
-    /etc/ca-certificates.conf && \
-    update-ca-certificates && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \
diff --git a/apps/hash-frontend/docker/Dockerfile b/apps/hash-frontend/docker/Dockerfile
index 3ae1878fc7a..c27d262c5ca 100644
--- a/apps/hash-frontend/docker/Dockerfile
+++ b/apps/hash-frontend/docker/Dockerfile
@@ -11,15 +11,10 @@ ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
 
-# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    sed -i \
-    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
-    /etc/ca-certificates.conf && \
-    update-ca-certificates && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \
diff --git a/apps/hash-graph/docker/Dockerfile b/apps/hash-graph/docker/Dockerfile
index 7e33a338aa4..ac7316fb9f4 100644
--- a/apps/hash-graph/docker/Dockerfile
+++ b/apps/hash-graph/docker/Dockerfile
@@ -14,15 +14,11 @@ ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
 
-# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413. The runner copies this bundle.
+# The runner copies this bundle.
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    sed -i \
-    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
-    /etc/ca-certificates.conf && \
-    update-ca-certificates && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \
diff --git a/apps/hash-integration-worker/docker/Dockerfile b/apps/hash-integration-worker/docker/Dockerfile
index 917c18a7b02..5fdf3b4acbd 100644
--- a/apps/hash-integration-worker/docker/Dockerfile
+++ b/apps/hash-integration-worker/docker/Dockerfile
@@ -13,15 +13,10 @@ ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
 
-# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    sed -i \
-    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
-    /etc/ca-certificates.conf && \
-    update-ca-certificates && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \
diff --git a/apps/petrinaut-opt/docker/Dockerfile b/apps/petrinaut-opt/docker/Dockerfile
index b63f779d8a8..515b6a46082 100644
--- a/apps/petrinaut-opt/docker/Dockerfile
+++ b/apps/petrinaut-opt/docker/Dockerfile
@@ -27,11 +27,7 @@ COPY rust-toolchain.toml /tmp/rust-toolchain.toml
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    sed -i \
-    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
-    /etc/ca-certificates.conf && \
-    update-ca-certificates && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419~deb12u2 && \
     /etc/mise/install.sh && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
@@ -136,12 +132,11 @@ COPY apps/petrinaut-opt/src ./src
 # built workspace packages it resolves.
 COPY --from=bindings-runtime / /opt/petrinaut-runtime
 
-# Distrust until updated base image removes compromised intermediate CAs, see: https://bugs.debian.org/1151413
-RUN sed -i \
-    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
-    /etc/ca-certificates.conf && \
-    update-ca-certificates
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419~deb12u2 && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
 
 # `petrinaut` is the command the bindings spawn by default, and they give the
 # child a fixed PATH of /usr/local/bin:/usr/bin:/bin, so it is linked there.
diff --git a/infra/compose/hydra/Dockerfile b/infra/compose/hydra/Dockerfile
index 208cd86d176..0b5faa4d0ae 100644
--- a/infra/compose/hydra/Dockerfile
+++ b/infra/compose/hydra/Dockerfile
@@ -2,9 +2,7 @@ FROM oryd/hydra:v25.4
 
 USER root
 
-# Distrust until updated base image removes compromised intermediate CAs, see: https://emudhra.we-have-a-problem.com/
-RUN sed -i -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' /etc/ca-certificates.conf && \
-    update-ca-certificates
+RUN apk add --no-cache 'ca-certificates>=20261020-r0' 'ca-certificates-bundle>=20261020-r0'
 
 RUN mkdir -p /home/nonroot/.postgresql
 
diff --git a/infra/compose/kratos/Dockerfile b/infra/compose/kratos/Dockerfile
index 0a45e97c5ec..89a2ba3c3dc 100644
--- a/infra/compose/kratos/Dockerfile
+++ b/infra/compose/kratos/Dockerfile
@@ -1,13 +1,8 @@
-# Distrust until updated base image removes compromised intermediate CAs, see: https://emudhra.we-have-a-problem.com/
 FROM debian:13.3-slim AS ca-certificates
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends ca-certificates && \
-    sed -i \
-    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
-    /etc/ca-certificates.conf && \
-    update-ca-certificates
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1
 
 
 FROM oryd/kratos:v26.2.0-distroless
diff --git a/libs/@local/graph/atlas/docker/Dockerfile b/libs/@local/graph/atlas/docker/Dockerfile
index a02cdd4b1ce..6a9d9873a62 100644
--- a/libs/@local/graph/atlas/docker/Dockerfile
+++ b/libs/@local/graph/atlas/docker/Dockerfile
@@ -20,11 +20,7 @@ COPY .config/mise /etc/mise
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates && \
-    sed -i \
-    -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' \
-    -e 's|^mozilla/Comodo_AAA_Services_root.crt|!&|' \
-    /etc/ca-certificates.conf && \
-    update-ca-certificates && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1 && \
     /etc/mise/install.sh && \
     mise --version && \
     apt-get clean && \

From ab60590c8f018f185802e38e308c699329285a04 Mon Sep 17 00:00:00 2001
From: Bilal Mahmoud <7252775+indietyp@users.noreply.github.com>
Date: Wed, 21 Oct 2026 01:15:03 +0200
Subject: [PATCH 4/6] chore: exclude problematic mozilla root certificate

---
 infra/compose/hydra/Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/infra/compose/hydra/Dockerfile b/infra/compose/hydra/Dockerfile
index 0b5faa4d0ae..d2cf76d560d 100644
--- a/infra/compose/hydra/Dockerfile
+++ b/infra/compose/hydra/Dockerfile
@@ -2,7 +2,8 @@ FROM oryd/hydra:v25.4
 
 USER root
 
-RUN apk add --no-cache 'ca-certificates>=20261020-r0' 'ca-certificates-bundle>=20261020-r0'
+RUN sed -i -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' /etc/ca-certificates.conf && \
+    update-ca-certificates
 
 RUN mkdir -p /home/nonroot/.postgresql
 

From bb5c8375c4a24ca59be4d636606f3b060bf45f71 Mon Sep 17 00:00:00 2001
From: Bilal Mahmoud <7252775+indietyp@users.noreply.github.com>
Date: Wed, 21 Oct 2026 13:38:15 +0200
Subject: [PATCH 5/6] chore: track eMudhra CA workarounds

---
 apps/brunch-agent/docker/Dockerfile            | 2 +-
 apps/hash-ai-worker-ts/docker/Dockerfile       | 2 +-
 apps/hash-api/docker/Dockerfile                | 2 +-
 apps/hash-frontend/docker/Dockerfile           | 2 +-
 apps/hash-graph/docker/Dockerfile              | 2 +-
 apps/hash-integration-worker/docker/Dockerfile | 2 +-
 apps/petrinaut-opt/docker/Dockerfile           | 2 +-
 infra/compose/hydra/Dockerfile                 | 1 +
 infra/compose/kratos/Dockerfile                | 1 +
 libs/@local/graph/atlas/docker/Dockerfile      | 2 +-
 10 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/apps/brunch-agent/docker/Dockerfile b/apps/brunch-agent/docker/Dockerfile
index 63fc0a711d4..8f1e6f295b7 100644
--- a/apps/brunch-agent/docker/Dockerfile
+++ b/apps/brunch-agent/docker/Dockerfile
@@ -11,7 +11,7 @@ ENV MISE_DATA_DIR="/mise"
 ENV MISE_CACHE_DIR="/mise/cache"
 ENV PATH="/mise/shims:$PATH"
 
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+# TODO(SRE-1221): Remove this override after upgrading Node.js to a release without the affected eMudhra roots: https://github.com/nodejs/node/pull/66871
 ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
diff --git a/apps/hash-ai-worker-ts/docker/Dockerfile b/apps/hash-ai-worker-ts/docker/Dockerfile
index 97bff1b96d3..d70021feae0 100644
--- a/apps/hash-ai-worker-ts/docker/Dockerfile
+++ b/apps/hash-ai-worker-ts/docker/Dockerfile
@@ -8,7 +8,7 @@ ENV MISE_DATA_DIR="/mise"
 ENV MISE_CACHE_DIR="/mise/cache"
 ENV PATH="/mise/shims:$PATH"
 
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+# TODO(SRE-1221): Remove this override after upgrading Node.js to a release without the affected eMudhra roots: https://github.com/nodejs/node/pull/66871
 ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
diff --git a/apps/hash-api/docker/Dockerfile b/apps/hash-api/docker/Dockerfile
index 4437485cd97..99be56c19d5 100644
--- a/apps/hash-api/docker/Dockerfile
+++ b/apps/hash-api/docker/Dockerfile
@@ -8,7 +8,7 @@ ENV MISE_DATA_DIR="/mise"
 ENV MISE_CACHE_DIR="/mise/cache"
 ENV PATH="/mise/shims:$PATH"
 
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+# TODO(SRE-1221): Remove this override after upgrading Node.js to a release without the affected eMudhra roots: https://github.com/nodejs/node/pull/66871
 ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
diff --git a/apps/hash-frontend/docker/Dockerfile b/apps/hash-frontend/docker/Dockerfile
index c27d262c5ca..e3438f9de61 100644
--- a/apps/hash-frontend/docker/Dockerfile
+++ b/apps/hash-frontend/docker/Dockerfile
@@ -6,7 +6,7 @@ ENV MISE_DATA_DIR="/mise"
 ENV MISE_CACHE_DIR="/mise/cache"
 ENV PATH="/mise/shims:$PATH"
 
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+# TODO(SRE-1221): Remove this override after upgrading Node.js to a release without the affected eMudhra roots: https://github.com/nodejs/node/pull/66871
 ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
diff --git a/apps/hash-graph/docker/Dockerfile b/apps/hash-graph/docker/Dockerfile
index ac7316fb9f4..e9855464e85 100644
--- a/apps/hash-graph/docker/Dockerfile
+++ b/apps/hash-graph/docker/Dockerfile
@@ -9,7 +9,7 @@ ENV MISE_CACHE_DIR="/mise/cache"
 ENV MISE_NODE_COREPACK=1
 ENV PATH="/mise/shims:$PATH"
 
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+# TODO(SRE-1221): Remove this override after upgrading Node.js to a release without the affected eMudhra roots: https://github.com/nodejs/node/pull/66871
 ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
diff --git a/apps/hash-integration-worker/docker/Dockerfile b/apps/hash-integration-worker/docker/Dockerfile
index 5fdf3b4acbd..daed4bfa97a 100644
--- a/apps/hash-integration-worker/docker/Dockerfile
+++ b/apps/hash-integration-worker/docker/Dockerfile
@@ -8,7 +8,7 @@ ENV MISE_DATA_DIR="/mise"
 ENV MISE_CACHE_DIR="/mise/cache"
 ENV PATH="/mise/shims:$PATH"
 
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+# TODO(SRE-1221): Remove this override after upgrading Node.js to a release without the affected eMudhra roots: https://github.com/nodejs/node/pull/66871
 ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
diff --git a/apps/petrinaut-opt/docker/Dockerfile b/apps/petrinaut-opt/docker/Dockerfile
index 515b6a46082..2487327792b 100644
--- a/apps/petrinaut-opt/docker/Dockerfile
+++ b/apps/petrinaut-opt/docker/Dockerfile
@@ -17,7 +17,7 @@ ENV MISE_CACHE_DIR="/mise/cache"
 ENV MISE_CARGO_HOME="/usr/local/cargo"
 ENV PATH="/mise/shims:/usr/local/cargo/bin:$PATH"
 
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+# TODO(SRE-1221): Remove this override after upgrading Node.js to a release without the affected eMudhra roots: https://github.com/nodejs/node/pull/66871
 ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise
diff --git a/infra/compose/hydra/Dockerfile b/infra/compose/hydra/Dockerfile
index d2cf76d560d..6d969571ce9 100644
--- a/infra/compose/hydra/Dockerfile
+++ b/infra/compose/hydra/Dockerfile
@@ -2,6 +2,7 @@ FROM oryd/hydra:v25.4
 
 USER root
 
+# TODO(SRE-1231): Remove this exclusion once the upstream image rejects the affected eMudhra chains.
 RUN sed -i -e 's|^mozilla/emSign_ECC_Root_CA_-_G3.crt|!&|' /etc/ca-certificates.conf && \
     update-ca-certificates
 
diff --git a/infra/compose/kratos/Dockerfile b/infra/compose/kratos/Dockerfile
index 89a2ba3c3dc..c30b3a50e85 100644
--- a/infra/compose/kratos/Dockerfile
+++ b/infra/compose/kratos/Dockerfile
@@ -1,3 +1,4 @@
+# TODO(SRE-1231): Remove this stage and its bundle copy once upstream Kratos rejects the affected eMudhra chains.
 FROM debian:13.3-slim AS ca-certificates
 
 RUN apt-get update && \
diff --git a/libs/@local/graph/atlas/docker/Dockerfile b/libs/@local/graph/atlas/docker/Dockerfile
index 6a9d9873a62..71d20ca9338 100644
--- a/libs/@local/graph/atlas/docker/Dockerfile
+++ b/libs/@local/graph/atlas/docker/Dockerfile
@@ -12,7 +12,7 @@ ENV MISE_CACHE_DIR="/mise/cache"
 ENV MISE_NODE_COREPACK=1
 ENV PATH="/mise/shims:$PATH"
 
-# Use the system trust store until updated Node.js removes compromised intermediate CAs, see: https://github.com/nodejs/node/pull/66871
+# TODO(SRE-1221): Remove this override after upgrading Node.js to a release without the affected eMudhra roots: https://github.com/nodejs/node/pull/66871
 ENV NODE_OPTIONS=--use-openssl-ca
 
 COPY .config/mise /etc/mise

From 7d3d006efd1926c1fefa1036c8ac2029cfdf9799 Mon Sep 17 00:00:00 2001
From: Bilal Mahmoud <7252775+indietyp@users.noreply.github.com>
Date: Wed, 21 Oct 2026 14:19:37 +0200
Subject: [PATCH 6/6] chore: require updated ca-certificates in atlas images

---
 libs/@local/graph/atlas/docker/Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libs/@local/graph/atlas/docker/Dockerfile b/libs/@local/graph/atlas/docker/Dockerfile
index 71d20ca9338..7827002390d 100644
--- a/libs/@local/graph/atlas/docker/Dockerfile
+++ b/libs/@local/graph/atlas/docker/Dockerfile
@@ -65,6 +65,7 @@ COPY rust-toolchain.toml .
 RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \
     apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates build-essential && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20260816ubuntu0.24.04.1 && \
     /etc/mise/install.sh && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
@@ -112,6 +113,7 @@ RUN cuda="${CUDA_VERSION%.*}" && \
     apt-get update && \
     apt-get install -y --no-install-recommends \
     "cuda-nvrtc-${cuda}" "cuda-cudart-dev-${cuda}" "cuda-cccl-${cuda}" ca-certificates && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20260816ubuntu0.24.04.1 && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
     ldconfig && \