diff --git a/.github/actions/harden-pip/action.yml b/.github/actions/harden-pip/action.yml
new file mode 100644
index 00000000000..868c30295f5
--- /dev/null
+++ b/.github/actions/harden-pip/action.yml
@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Harden pip
+description: >-
+  Install the security-fixed pip (26.2.2) from a hash-pinned wheel so that later
+  pip invocations do not fall back on the vendored certifi bundle that trusts the
+  compromised eMudhra/emSign intermediate CAs. The sha256 fragment guarantees the
+  bootstrap download's integrity even if the bootstrapping pip's trust store is
+  compromised. See https://github.com/NVIDIA/cuda-python/issues/3195 and
+  https://discuss.python.org/t/109576.
+
+inputs:
+  python:
+    description: Python interpreter whose pip should be hardened (e.g. a venv's python).
+    default: python
+
+runs:
+  using: composite
+  steps:
+    - name: Install hash-pinned pip 26.2.2
+      shell: bash --noprofile --norc -xeuo pipefail {0}
+      env:
+        HARDEN_PIP_PYTHON: ${{ inputs.python }}
+      run: |
+        "${HARDEN_PIP_PYTHON}" -m pip install \
+          "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
diff --git a/.github/workflows/build-wheel.yml b/.github/workflows/build-wheel.yml
index 80d4719ddde..1a5880ae9b7 100644
--- a/.github/workflows/build-wheel.yml
+++ b/.github/workflows/build-wheel.yml
@@ -59,6 +59,9 @@ jobs:
           # see https://github.com/actions/setup-python/issues/871
           python-version: "3.12"
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Set up MSVC
         if: ${{ startsWith(inputs.host-platform, 'win') }}
         uses: ilammy/msvc-dev-cmd@v1  # TODO: ask admin to allow pinning commits
@@ -112,7 +115,7 @@ jobs:
           if-no-files-found: error
 
       - name: Build cuda.core wheel
-        uses: pypa/cibuildwheel@b3395e271a35f73dad77f21802abe9b986dfe299  # v4.3.1
+        uses: pypa/cibuildwheel@b9e566a2b284570af229f6c2a33673410d0389a3  # v4.3.4
         env:
           CIBW_BUILD: ${{ env.CIBW_BUILD }}
           CIBW_ARCHS_LINUX: "native"
@@ -155,7 +158,7 @@ jobs:
           cuda-version: ${{ inputs.cuda-version }}
 
       - name: Build cuda.bindings wheel
-        uses: pypa/cibuildwheel@b3395e271a35f73dad77f21802abe9b986dfe299  # v4.3.1
+        uses: pypa/cibuildwheel@b9e566a2b284570af229f6c2a33673410d0389a3  # v4.3.4
         env:
           CIBW_BUILD: ${{ env.CIBW_BUILD }}
           CIBW_ARCHS_LINUX: "native"
@@ -231,6 +234,9 @@ jobs:
           # TODO: remove allow-prereleases once 3.15 is officially supported
           allow-prereleases: ${{ startsWith(matrix.python-version, '3.15') }}
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: verify free-threaded build
         if: endsWith(matrix.python-verison, 't')
         run: python -c 'import sys; assert not sys._is_gil_enabled()'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index eecadfc68e7..ee2ef624f72 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -173,11 +173,11 @@ jobs:
 
       - name: Publish package distributions to PyPI
         if: ${{ inputs.wheel-dst == 'pypi' }}
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
 
       - name: Publish package distributions to TestPyPI
         if: ${{ inputs.wheel-dst == 'testpypi' }}
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
         with:
           repository-url: https://test.pypi.org/legacy/
 
diff --git a/.github/workflows/test-wheel-linux.yml b/.github/workflows/test-wheel-linux.yml
index 776e84116ad..019861ee832 100644
--- a/.github/workflows/test-wheel-linux.yml
+++ b/.github/workflows/test-wheel-linux.yml
@@ -224,6 +224,9 @@ jobs:
           # we use self-hosted runners on which setup-python behaves weirdly...
           AGENT_TOOLSDIRECTORY: "/opt/hostedtoolcache"
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Set up mini CTK
         if: ${{ matrix.LOCAL_CTK == '1' }}
         uses: ./.github/actions/fetch_ctk
diff --git a/.github/workflows/test-wheel-windows.yml b/.github/workflows/test-wheel-windows.yml
index d6dec2461fb..9ed697fc4b8 100644
--- a/.github/workflows/test-wheel-windows.yml
+++ b/.github/workflows/test-wheel-windows.yml
@@ -211,6 +211,9 @@ jobs:
           # TODO: remove allow-prereleases once 3.15 is officially supported
           allow-prereleases: ${{ startsWith(matrix.PY_VER, '3.15') }}
 
+      - name: Harden pip
+        uses: ./.github/actions/harden-pip
+
       - name: Verify LongPathsEnabled
         run: |
           $val = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem' -Name 'LongPathsEnabled').LongPathsEnabled