diff --git a/distros/alma9/distro.env b/distros/alma9/distro.env
index ffe5b18..a020560 100644
--- a/distros/alma9/distro.env
+++ b/distros/alma9/distro.env
@@ -9,8 +9,8 @@ IMAGE="almalinux9"
 # this package is installed, so it is fetched over plain HTTP and verified against a
 # pinned sha256 before rpm -i. The hash is the pkgid checksum recorded for this file
 # in the rpm-vendor-el9 repodata (repodata/repomd.xml -> *-primary.xml.gz).
-CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2025.7.13-1.el9.x86_64.rpm"
-CA_RPM_SHA256="c12fb81ea639a92d19506e07e88df290635b15e175b1f8c063d4e8a2d86bab6e"
+CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el9/Packages/unkin-ca-certificates-2026.10.2-1.el9.x86_64.rpm"
+CA_RPM_SHA256="e0de185c10086c37b6305995e1724112f48d25e8fbfae33d1bdaccf7a0711459"
 
 # Estate local repo used to prove HTTPS trust and dnf reachability.
 ESTATE_REPO="rpm-vendor-el9"