diff --git a/CHANGELOG.md b/CHANGELOG.md
index 59c33c26..1e7394c9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.1.16
+
+### Fixes
+
+- **Bump locked `certifi` to 2026.10.19**: The release removes the emSign ECC Root CA - G3 root after eight eMudhra intermediate CA private keys were compromised. `requests` and `httpx` trust certifi's bundle and do not check revocation, so with the older bundle they accepted certificates chaining to that root. The Docker image installs from the lockfile and picks it up, and `certifi>=2026.10.19` is recorded in `constraint-dependencies` so future relocks cannot fall below it.
+- **Bump uv in the Docker image to 0.13.4**: Earlier uv releases bundle a CA store that trusts the same emSign ECC Root CA - G3 ([GHSA-hq85-5cpj-mr62](https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62)). uv 0.13.4 drops it, so package downloads during the image build no longer trust certificates chaining to that root.
+
 ## 0.1.15
 
 ### Fixes
diff --git a/Dockerfile b/Dockerfile
index 40ed4cbc..ff91c5d6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,7 @@ ARG PYTHON_VERSION="3.12"
 # Set up environment
 ENV PYTHON=python${PYTHON_VERSION}
 
-COPY --from=ghcr.io/astral-sh/uv:0.10.0 /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv
 
 USER root
 
diff --git a/prepline_general/api/__version__.py b/prepline_general/api/__version__.py
index 9ada8c84..d7e5d581 100644
--- a/prepline_general/api/__version__.py
+++ b/prepline_general/api/__version__.py
@@ -1 +1 @@
-__version__ = "0.1.15"  # pragma: no cover
+__version__ = "0.1.16"  # pragma: no cover
diff --git a/pyproject.toml b/pyproject.toml
index 70220775..0668cd7e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -52,6 +52,8 @@ constraint-dependencies = [
     "starlette>=1.1.0",
     # lxml >=6.1.1 fixes CVE-2026-41066 (HIGH)
     "lxml>=6.1.1",
+    # certifi >=2026.10.19 removes emSign ECC Root CA - G3 (eMudhra intermediate CA key compromise)
+    "certifi>=2026.10.19",
 ]
 
 [[tool.uv.index]]
diff --git a/uv.lock b/uv.lock
index 2f97851c..576451b6 100644
--- a/uv.lock
+++ b/uv.lock
@@ -28,6 +28,7 @@ resolution-markers = [
 
 [manifest]
 constraints = [
+    { name = "certifi", specifier = ">=2026.10.19" },
     { name = "lxml", specifier = ">=6.1.1" },
     { name = "pdfminer-six", specifier = "==20260107" },
     { name = "starlette", specifier = ">=1.1.0" },
@@ -156,11 +157,11 @@ wheels = [
 
 [[package]]
 name = "certifi"
-version = "2026.4.22"
+version = "2026.10.19"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/25/ee/6caf7a40c36a1220410afe15a1cc64993a1f864871f698c0f93acb72842a/certifi-2026.4.22.tar.gz", hash = "sha256:8d455352a37b71bf76a79caa83a3d6c25afee4a385d632127b6afb3963f1c580", size = 137077, upload-time = "2026-04-22T11:26:11.191Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/22/30/7cd8fdcdfbc5b869528b079bfb76dcdf6056b1a2097a662e5e8c04f42965/certifi-2026.4.22-py3-none-any.whl", hash = "sha256:3cb2210c8f88ba2318d29b0388d1023c8492ff72ecdde4ebdaddbb13a31b1c4a", size = 135707, upload-time = "2026-04-22T11:26:09.372Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" },
 ]
 
 [[package]]