diff --git a/.github/workflows/build-thrift.yml b/.github/workflows/build-thrift.yml
index 12931ceee67..01427ebae5b 100644
--- a/.github/workflows/build-thrift.yml
+++ b/.github/workflows/build-thrift.yml
@@ -82,7 +82,9 @@ jobs:
           CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
           # test-sources paths are relative to cibuildwheel's cwd (the checkout root),
           # not to package-dir, and are staged at that same relative path.
-          CIBW_TEST_SOURCES: lib/py/test
+          # test_sslsocket.py loads its certificates from <checkout root>/test/keys
+          # (three levels above lib/py/test), so stage that directory too.
+          CIBW_TEST_SOURCES: lib/py/test test/keys
           # Upstream's own wheel test is the fastbinary import; the rest is its
           # `make check` list minus the cases needing code generated by the thrift
           # compiler (thrift_TNonblockingServer, thrift_TSerializer,
diff --git a/docs/packages/thrift.yaml b/docs/packages/thrift.yaml
index 0cb0d5e68c3..05fbdf0c4d8 100644
--- a/docs/packages/thrift.yaml
+++ b/docs/packages/thrift.yaml
@@ -13,3 +13,4 @@ versions:
     sha256: 70a9c6ad73ae7412e187b3735c3ff33ddff3b527cd060a5a2c065804dcde1e4f
   - filename: thrift-0.24.0-cp314-cp314t-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl
     sha256: c5aa9c1589a6f4d89a68817e47a42479b3588413119c8bc0ef48c5edaf748bcc
+- version: 0.25.0