diff --git a/java-11/Dockerfile b/java-11/Dockerfile
index 77a9be7..3fe7fbd 100644
--- a/java-11/Dockerfile
+++ b/java-11/Dockerfile
@@ -47,6 +47,40 @@ jdk.zipfs\
 # Extract java SSL certs
 FROM gcr.io/distroless/java-base-debian12:debug AS ssl
 
+# TEMP: eMudhra/Comodo AAA distrust, see https://openjdk.org/emudhra
+# Remove the base-ca and emudhra-clean stages and the "COPY --from=emudhra-clean" lines in the
+# final image once the Zulu JDK, the distroless java-base image and BASE_IMAGE no longer ship
+# these roots.
+# jlink copies cacerts out of java.base.jmod, so the JDK's own cacerts is not what ships in /jre.
+# The distroless store uses subject DN aliases and has no keytool.
+# The PEM bundle in the final image comes from BASE_IMAGE and also has the eMudhra roots.
+FROM ${BASE_IMAGE} AS base-ca
+
+FROM jre AS emudhra-clean
+COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
+COPY --from=base-ca /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+# Java stores: delete every entry whose owner is eMudhra or AAA Certificate Services (matched by
+# subject, aliases differ between the two stores).
+RUN for store in /jre/lib/security/cacerts /etc/ssl/certs/java/cacerts; do \
+    keytool -list -v -keystore "$store" -storepass changeit \
+      | awk '/^Alias name: /{a=substr($0,13)} /^Owner: /{if (tolower($0) ~ /emudhra|aaa certificate services/) print a}' \
+      > /tmp/aliases; \
+    while IFS= read -r alias; do \
+      echo "Removing '$alias' from $store"; \
+      keytool -delete -keystore "$store" -storepass changeit -alias "$alias"; \
+    done < /tmp/aliases; \
+done
+# Drop every eMudhra root (emSign ECC Root CA - C3/G3, emSign Root CA - C1/G1) from the PEM bundle,
+# matched by subject.
+RUN mkdir /tmp/ca && cd /tmp/ca \
+    && awk '/-----BEGIN CERTIFICATE-----/{n++} n{print > sprintf("c%04d.pem", n)}' /etc/ssl/certs/ca-certificates.crt \
+    && for f in c*.pem; do \
+      if openssl x509 -in "$f" -noout -subject | grep -qi 'eMudhra'; then \
+        echo "Removing: $(openssl x509 -in "$f" -noout -subject)"; rm "$f"; \
+      fi; \
+    done \
+    && cat c*.pem > /etc/ssl/certs/ca-certificates.crt
+
 FROM debian:bookworm-slim As builder
 RUN apt update && apt install -y libjemalloc-dev
 
@@ -82,6 +116,10 @@ FROM base-${TARGETARCH}
 
 COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
 COPY --from=jre /jre /usr/lib/jvm/zulu-11-slim
+# TEMP: eMudhra distrust, see emudhra-clean stage above
+COPY --from=emudhra-clean /jre/lib/security/cacerts /usr/lib/jvm/zulu-11-slim/lib/security/cacerts
+COPY --from=emudhra-clean /etc/ssl/certs/java/cacerts /etc/ssl/certs/java/cacerts
+COPY --from=emudhra-clean /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
 RUN ln -s /usr/lib/jvm/zulu-11-slim/bin/java /usr/bin/java
 RUN ln -s /usr/lib/jvm/zulu-11-slim/bin/jfr /usr/bin/jfr
diff --git a/java-21/Dockerfile b/java-21/Dockerfile
index a452763..dc112d9 100644
--- a/java-21/Dockerfile
+++ b/java-21/Dockerfile
@@ -47,6 +47,40 @@ jdk.zipfs\
 # Extract java SSL certs
 FROM gcr.io/distroless/java-base-debian12:debug AS ssl
 
+# TEMP: eMudhra/Comodo AAA distrust, see https://openjdk.org/emudhra
+# Remove the base-ca and emudhra-clean stages and the "COPY --from=emudhra-clean" lines in the
+# final image once the Zulu JDK, the distroless java-base image and BASE_IMAGE no longer ship
+# these roots.
+# jlink copies cacerts out of java.base.jmod, so the JDK's own cacerts is not what ships in /jre.
+# The distroless store uses subject DN aliases and has no keytool.
+# The PEM bundle in the final image comes from BASE_IMAGE and also has the eMudhra roots.
+FROM ${BASE_IMAGE} AS base-ca
+
+FROM jre AS emudhra-clean
+COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
+COPY --from=base-ca /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+# Java stores: delete every entry whose owner is eMudhra or AAA Certificate Services (matched by
+# subject, aliases differ between the two stores).
+RUN for store in /jre/lib/security/cacerts /etc/ssl/certs/java/cacerts; do \
+    keytool -list -v -keystore "$store" -storepass changeit \
+      | awk '/^Alias name: /{a=substr($0,13)} /^Owner: /{if (tolower($0) ~ /emudhra|aaa certificate services/) print a}' \
+      > /tmp/aliases; \
+    while IFS= read -r alias; do \
+      echo "Removing '$alias' from $store"; \
+      keytool -delete -keystore "$store" -storepass changeit -alias "$alias"; \
+    done < /tmp/aliases; \
+done
+# Drop every eMudhra root (emSign ECC Root CA - C3/G3, emSign Root CA - C1/G1) from the PEM bundle,
+# matched by subject.
+RUN mkdir /tmp/ca && cd /tmp/ca \
+    && awk '/-----BEGIN CERTIFICATE-----/{n++} n{print > sprintf("c%04d.pem", n)}' /etc/ssl/certs/ca-certificates.crt \
+    && for f in c*.pem; do \
+      if openssl x509 -in "$f" -noout -subject | grep -qi 'eMudhra'; then \
+        echo "Removing: $(openssl x509 -in "$f" -noout -subject)"; rm "$f"; \
+      fi; \
+    done \
+    && cat c*.pem > /etc/ssl/certs/ca-certificates.crt
+
 FROM debian:bookworm-slim AS builder
 RUN apt update && apt install -y libjemalloc-dev
 
@@ -82,6 +116,10 @@ FROM base-${TARGETARCH}
 
 COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
 COPY --from=jre /jre /usr/lib/jvm/zulu-21-slim
+# TEMP: eMudhra distrust, see emudhra-clean stage above
+COPY --from=emudhra-clean /jre/lib/security/cacerts /usr/lib/jvm/zulu-21-slim/lib/security/cacerts
+COPY --from=emudhra-clean /etc/ssl/certs/java/cacerts /etc/ssl/certs/java/cacerts
+COPY --from=emudhra-clean /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
 RUN ln -s /usr/lib/jvm/zulu-21-slim/bin/java /usr/bin/java
 RUN ln -s /usr/lib/jvm/zulu-21-slim/bin/jfr /usr/bin/jfr