diff --git a/CHANGELOG.md b/CHANGELOG.md
index e6e7a73f..4b44c9ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,10 @@
 
 - `comment list` for issues, projects, documents and initiatives marks resolved threads `[resolved]`, and its `--json` output includes `resolvedAt`, `resolvingCommentId` and `resolvingUser` like `issue view --json`, plus `parent.resolvedAt`, the thread state of a reply
 
+### Fixed
+
+- Reject TLS certificate chains using the [compromised eMudhra intermediate CAs](https://emudhra.we-have-a-problem.com/), including chains trusted through the OS store or `SSL_CERT_FILE`, and remove the affected root from the bundled Mozilla roots. New releases also fetch the patched standalone `linear-update` updater
+
 ## [3.0.0] - 2026-10-06
 
 ### Upgrading from 2.x
diff --git a/Cargo.lock b/Cargo.lock
index b0904632..09c7d41b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1730,9 +1730,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -2429,9 +2429,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
 dependencies = [
  "rustls-pki-types",
 ]
diff --git a/dist-workspace.toml b/dist-workspace.toml
index f78b5669..0cbaa18c 100644
--- a/dist-workspace.toml
+++ b/dist-workspace.toml
@@ -23,6 +23,8 @@ npm-package = "linear-cli"
 install-path = "CARGO_HOME"
 # Whether to install an updater program
 install-updater = true
+# Use axoupdater 0.10.3+ for its eMudhra fix; dist 0.31.0 pins 0.10.0.
+always-use-latest-updater = true
 # Steps run before each build-local-artifacts job (relative to .github/workflows).
 # They write THIRD_PARTY_LICENSES.md, which `include` adds to every archive.
 github-build-setup = "../build-setup.yml"