The pinned 2025.7.13 package shipped only the root anchor (CN=unkin.net).
Hosts that present a bare leaf issued by CN=unkin.net Intermediate
Authority — s3.ceph.unkin.net among them — fail to verify from images
built on this base.
- Pin CA_RPM_URL/CA_RPM_SHA256 to unkin-ca-certificates-2026.10.2-1.el9,
which installs both the root and intermediate anchors.