diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1174f73..8550e35 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+- Security: updated `webpki-roots` to 1.0.11 in the workspace so the TLS trust
+  store matches the current upstream root set.
+
 Fix: added helpers to deserialize datetime correctly, fixes bug where cant change systemsettings on fresh deployments.
 Infra: nix modularization using flake-parts, added lints and additional checks like statix and deadnix.
 Infra: CI test gate now runs the full workspace suite (`cargo test --workspace`).
diff --git a/Cargo.lock b/Cargo.lock
index 1be1b27..6563b14 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -667,7 +667,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tungstenite 0.29.0",
- "webpki-roots 1.0.6",
+ "webpki-roots 1.0.11",
 ]
 
 [[package]]
@@ -4334,7 +4334,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots 1.0.6",
+ "webpki-roots 1.0.11",
 ]
 
 [[package]]
@@ -8364,7 +8364,7 @@ dependencies = [
  "wasm-bindgen-futures",
  "wasm-streams 0.4.2",
  "web-sys",
- "webpki-roots 1.0.6",
+ "webpki-roots 1.0.11",
 ]
 
 [[package]]
@@ -10244,7 +10244,7 @@ dependencies = [
  "tungstenite 0.29.0",
  "url",
  "uuid",
- "webpki-roots 1.0.6",
+ "webpki-roots 1.0.11",
  "webrender_api",
 ]
 
@@ -12818,7 +12818,7 @@ dependencies = [
  "rustls-pki-types",
  "ureq-proto",
  "utf8-zero",
- "webpki-roots 1.0.6",
+ "webpki-roots 1.0.11",
 ]
 
 [[package]]
@@ -13303,14 +13303,14 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
 dependencies = [
- "webpki-roots 1.0.6",
+ "webpki-roots 1.0.11",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.6"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cfaf3c063993ff62e73cb4311efde4db1efb31ab78a3e5c457939ad5cc0bed"
+checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171"
 dependencies = [
  "rustls-pki-types",
 ]