diff --git a/docker/Dockerfile b/docker/Dockerfile
index d3d1744bbae..cd6d86ff74d 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -760,6 +760,7 @@ RUN PYTHON_VERSION_STR=$(echo ${PYTHON_VERSION} | sed 's/\.//g') && \
 # Install Python and system dependencies
 RUN apt-get update -y \
     && apt-get install -y --no-install-recommends \
+        ca-certificates \
         software-properties-common \
         curl \
         sudo \
diff --git a/docs/contributing/dockerfile/dockerfile.md b/docs/contributing/dockerfile/dockerfile.md
index 279c8f0c6a3..ddd75129798 100644
--- a/docs/contributing/dockerfile/dockerfile.md
+++ b/docs/contributing/dockerfile/dockerfile.md
@@ -20,6 +20,11 @@ The edges of the build graph represent:
 The `test-deps` stage branches from `vllm-runtime-base` so Git and the test
 requirements remain cached independently of per-commit vLLM wheels and source.
 
+The `vllm-runtime-base` stage explicitly installs the current Ubuntu
+`ca-certificates` package so clients using the system trust store receive
+certificate removals when the image is rebuilt. This complements the Python
+`certifi` bundle used by other HTTP clients.
+
 The `extensions-build` stage can also produce an optional source-built Triton
 wheel. `vllm-openai-base` installs that wheel after its other Python
 dependencies so dependency resolution cannot restore an older Triton version.
diff --git a/pyproject.toml b/pyproject.toml
index 4f25ce30618..46c836043ca 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -228,6 +228,7 @@ view_seperator = "view_seperator"
 inverse_std_variences = "inverse_std_variences"
 
 [tool.typos.default.extend-words]
+certifi = "certifi"
 MoNE = "MoNE"
 mone = "mone"
 Hel = "Hel"
diff --git a/requirements/common.txt b/requirements/common.txt
index 77c611a6a11..6b67eca537c 100644
--- a/requirements/common.txt
+++ b/requirements/common.txt
@@ -4,6 +4,7 @@ psutil
 sentencepiece  # Required for LLaMA tokenizer.
 numpy
 requests >= 2.33.0
+certifi >= 2026.10.19
 tqdm
 blake3
 py-cpuinfo
diff --git a/requirements/docs.in b/requirements/docs.in
index baabfa03312..0fe8d970fee 100644
--- a/requirements/docs.in
+++ b/requirements/docs.in
@@ -1,4 +1,5 @@
 mkdocs<2.0.0
+certifi>=2026.10.19
 mkdocs-api-autonav
 mkdocs-material
 mkdocstrings-python
diff --git a/requirements/docs.txt b/requirements/docs.txt
index efc92e94b5d..025214b6a32 100644
--- a/requirements/docs.txt
+++ b/requirements/docs.txt
@@ -10,8 +10,10 @@ backrefs==8.0
     # via mkdocs-material
 bracex==3.0.1
     # via wcmatch
-certifi==2026.7.22
-    # via requests
+certifi==2026.10.19
+    # via
+    #   -r requirements/docs.in
+    #   requests
 charset-normalizer==3.5.1
     # via requests
 click==8.5.0
diff --git a/requirements/test/cpu.txt b/requirements/test/cpu.txt
index 833b8beb76c..599b98a43f9 100644
--- a/requirements/test/cpu.txt
+++ b/requirements/test/cpu.txt
@@ -102,8 +102,9 @@ cachetools==5.5.2
     #   google-auth
 cbor2==6.1.2
     # via -r requirements/test/../common.txt
-certifi==2024.8.30
+certifi==2026.10.19
     # via
+    #   -r requirements/test/../common.txt
     #   httpcore
     #   httpx
     #   requests
diff --git a/requirements/test/cuda.txt b/requirements/test/cuda.txt
index 5ce587e455d..dc268719a6c 100644
--- a/requirements/test/cuda.txt
+++ b/requirements/test/cuda.txt
@@ -107,8 +107,10 @@ cachetools==5.5.2
     #   google-auth
 cbor2==6.1.2
     # via -r requirements/test/../common.txt
-certifi==2024.8.30
+certifi==2026.10.19
     # via
+    #   -c requirements/common.txt
+    #   -r requirements/test/../common.txt
     #   httpcore
     #   httpx
     #   requests
diff --git a/requirements/test/rocm.txt b/requirements/test/rocm.txt
index 3137ef84ce2..fb7390335f4 100644
--- a/requirements/test/rocm.txt
+++ b/requirements/test/rocm.txt
@@ -104,8 +104,10 @@ cachetools==7.0.5
     # via -r requirements/test/../common.txt
 cbor2==5.9.0
     # via -r requirements/test/../common.txt
-certifi==2026.2.25
+certifi==2026.10.19
     # via
+    #   -c requirements/common.txt
+    #   -r requirements/test/../common.txt
     #   httpcore
     #   httpx
     #   requests
diff --git a/requirements/test/xpu.txt b/requirements/test/xpu.txt
index a6b727a81a7..bcbada52456 100644
--- a/requirements/test/xpu.txt
+++ b/requirements/test/xpu.txt
@@ -89,8 +89,10 @@ cachetools==7.1.7
     # via -r requirements/test/../common.txt
 cbor2==6.1.4
     # via -r requirements/test/../common.txt
-certifi==2026.7.22
+certifi==2026.10.19
     # via
+    #   -c requirements/common.txt
+    #   -r requirements/test/../common.txt
     #   httpcore
     #   httpx
     #   requests