diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 650663b..ca21f03 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,7 +14,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: "3.8"
+          python-version: "3.12"
 
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a4ab751..24be1ef 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,7 +21,10 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install dependencies
+        # pip 26.2.2 removes the emSign ECC Root CA - G3 from its vendored certifi
+        # (eMudhra CA incident); the runner's pip is older.
         run: |
+          python -m pip install --upgrade "pip>=26.2.2"
           pip install -e .
           pip install -r requirements.txt
 
@@ -64,8 +67,11 @@ jobs:
 
       - name: Install dependencies
         # black is required by scripts/generate_v2_constants.py to format its output
-        # so the regenerated file matches the committed one byte-for-byte.
-        run: pip install -r requirements.txt
+        # so the regenerated file matches the committed one byte-for-byte. pip>=26.2.2:
+        # see the test job.
+        run: |
+          python -m pip install --upgrade "pip>=26.2.2"
+          pip install -r requirements.txt
 
       - name: Checkout plane-ee (api_v2 OpenAPI golden)
         # PLANE_EE_CHECKOUT_TOKEN: fine-grained PAT with read access to makeplane/plane-ee.
diff --git a/pyproject.toml b/pyproject.toml
index 931de2e..73c305d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,13 +4,19 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "plane-sdk"
-version = "0.3.1"
+version = "0.3.2"
 description = "Python SDK for Plane API"
 readme = "README.md"
 requires-python = ">=3.10"
 license = { text = "MIT" }
 authors = [{ name = "Plane", email = "engineering@plane.so" }]
-dependencies = ["requests>=2.31.0", "pydantic>=2.4.0", "typing_extensions>=4.7"]
+dependencies = [
+    "requests>=2.31.0",
+    "pydantic>=2.4.0",
+    "typing_extensions>=4.7",
+    # 2026.10.19 removes the emSign ECC Root CA - G3 (eMudhra CA incident, 2026-10-20).
+    "certifi>=2026.10.19",
+]
 
 [project.optional-dependencies]
 dev = ["pytest", "pytest-dependency"]
diff --git a/requirements.txt b/requirements.txt
index c761ec8..65a7ca5 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,7 @@
 # Runtime
 requests>=2.31.0
 pydantic>=2.4.0
+certifi>=2026.10.19
 
 # Dev / Lint / Test
 pytest>=7.4.0