From dc8904008521e4ccae16872a0511496545d1203a Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 09:20:22 +0000
Subject: [PATCH 1/2] fix(docker): Require ca-certificates 20261020-r0 or newer

Co-Authored-By: Daniel Szoke <7881302+szokeasaurusrex@users.noreply.github.com>
---
 CHANGELOG.md | 6 ++++++
 Dockerfile   | 3 ++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7a9f9c6781..92dc4b1eab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+### Fixes
+
+- (docker) Require `ca-certificates` 20261020-r0 or newer in the Docker image, which removes distrusted eMudhra/emSign root certificates ([#PLACEHOLDER](https://github.com/getsentry/sentry-cli/pull/PLACEHOLDER))
+
 ## 3.8.0
 
 ### Improvements
diff --git a/Dockerfile b/Dockerfile
index 06bcd64cd9..181833943c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,7 +22,8 @@ RUN cp target/release/sentry-cli /usr/local/bin/sentry-cli
 
 FROM alpine:3.22.0@sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715
 WORKDIR /work
-RUN apk add --no-cache ca-certificates
+# 20261020-r0 removes distrusted eMudhra/emSign root certificates.
+RUN apk add --no-cache 'ca-certificates>=20261020-r0'
 COPY ./docker-entrypoint.sh /
 COPY --from=sentry-build /usr/local/bin/sentry-cli /bin
 ENTRYPOINT ["/docker-entrypoint.sh"]

From 21a0a55dc11fff1a1418e39f47ab89ec8162b20f Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 09:20:43 +0000
Subject: [PATCH 2/2] meta(changelog): Link #3447

Co-Authored-By: Daniel Szoke <7881302+szokeasaurusrex@users.noreply.github.com>
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 92dc4b1eab..9667adf437 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Fixes
 
-- (docker) Require `ca-certificates` 20261020-r0 or newer in the Docker image, which removes distrusted eMudhra/emSign root certificates ([#PLACEHOLDER](https://github.com/getsentry/sentry-cli/pull/PLACEHOLDER))
+- (docker) Require `ca-certificates` 20261020-r0 or newer in the Docker image, which removes distrusted eMudhra/emSign root certificates ([#3447](https://github.com/getsentry/sentry-cli/pull/3447))
 
 ## 3.8.0