diff --git a/configuration.nix b/configuration.nix
index 657b5ee..aa74a6c 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -68,6 +68,14 @@
     }];
   };
 
+  # eMudhra intermediate CA key compromise (Oct 2026): distrust the two roots
+  # that cross-sign the compromised intermediates, matching the upstream NSS
+  # 3.131.1 fix. Drop this once nixos-26.05 ships cacert >= 3.131.1.
+  security.pki.caCertificateBlacklist = [
+    "emSign ECC Root CA - G3"
+    "Comodo AAA Services root"
+  ];
+
   environment.variables = {
     SBCL_HOME = "/run/current-system/sw/lib/sbcl";
   };