diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e6ba402..2dd4512 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,6 +49,8 @@ jobs:
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.13"
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10  # patched-pip
       - name: Install policy dependencies
         run: python -m pip install PyYAML==6.0.2
       - name: Require centrally approved immutable action commits
@@ -70,6 +72,8 @@ jobs:
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.12"
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10  # patched-pip
       - name: Install the SDK
         run: pip install -e .
       - name: Require durable replay and codec evidence
@@ -92,6 +96,8 @@ jobs:
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.12"
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10  # patched-pip
       - run: pip install -e '.[dev]'
       - run: ruff check src/ tests/
       - run: mypy src/durable_workflow/
@@ -107,6 +113,8 @@ jobs:
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.12"
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10  # patched-pip
       - run: pip install -e .
       - name: Measure the bounded absolute throughput signal
         continue-on-error: true
@@ -134,6 +142,8 @@ jobs:
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: ${{ matrix.python-version }}
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10  # patched-pip
       - run: pip install -e '.[dev]'
       - name: Run unit tests with stalled-thread diagnostics
         id: unit_tests
@@ -167,6 +177,8 @@ jobs:
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.12"
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10  # patched-pip
       - run: pip install build twine
       - run: python -m build
       - name: Compare built release metadata with the exact source commit
@@ -216,6 +228,8 @@ jobs:
         run: |
           printf 'COMPOSE_FILE=docker-compose.test.yml:docker-compose.native-cancellation.yml\n' >> "$GITHUB_ENV"
           printf 'DURABLE_WORKFLOW_NATIVE_SOURCE_QUALIFICATION=1\n' >> "$GITHUB_ENV"
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10  # patched-pip
       - run: pip install -e '.[dev]'
         working-directory: sdk-python
       - name: Configure isolated Docker project
diff --git a/.github/workflows/docs-pr.yml b/.github/workflows/docs-pr.yml
index c4f9f23..971220e 100644
--- a/.github/workflows/docs-pr.yml
+++ b/.github/workflows/docs-pr.yml
@@ -32,6 +32,8 @@ jobs:
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.12"
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10  # patched-pip
       - name: Install package and documentation dependencies
         run: pip install -e '.[docs]'
       - name: Install Chromium
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 78d7fa0..d9ee057 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -68,6 +68,8 @@ jobs:
             echo stable=false >> "$GITHUB_OUTPUT"
           fi
           echo "version=$version" >> "$GITHUB_OUTPUT"
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10  # patched-pip
       - name: Install package and documentation dependencies
         run: pip install -e '.[docs]'
       - name: Install Chromium
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 91bd577..567ad7f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -107,6 +107,9 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10  # patched-pip
+
       - name: Install build tools
         run: pip install build twine
 
@@ -152,6 +155,7 @@ jobs:
     permissions:
       actions: read
       contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
         with:
@@ -216,7 +220,6 @@ jobs:
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247  # release/v1
         with:
-          password: ${{ secrets.PYPI_TOKEN }}
           print-hash: true
           skip-existing: true
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cc446fe..44d48ae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.9.1] - 2026-10-22
+
+### Security
+
+- Require a patched certifi trust bundle that removes the affected emSign root.
+  Installing this version upgrades older certifi resolutions too. Normal TLS
+  and hostname verification and explicit private certificate authorities remain
+  unchanged.
+
 ## [2.9.0] - 2026-10-22
 
 ### Added
diff --git a/pyproject.toml b/pyproject.toml
index c32fbea..08f160e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "durable-workflow"
-version = "2.9.0"
+version = "2.9.1"
 description = "Python client and worker SDK for Durable Workflow Cloud and self-hosted Server"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -34,6 +34,7 @@ classifiers = [
 ]
 dependencies = [
     "httpx>=0.27",
+    "certifi>=2026.10.19",
     "fastavro>=1.12.2,<2",
 ]
 
@@ -75,8 +76,8 @@ durable-workflow-replay-conformance = "durable_workflow.replay_conformance:main"
 durable-workflow-workflow-updates-conformance = "durable_workflow.workflow_updates_conformance:main"
 
 [tool.durable-workflow]
-product-train = "2.9.0"
-registry-version = "2.9.0"
+product-train = "2.9.1"
+registry-version = "2.9.1"
 supported-server-versions = "2.8.0"
 worker-protocol-version = "1.20"
 control-plane-version = "2"