diff --git a/.github/workflows/pip_audit.yaml b/.github/workflows/pip_audit.yaml
index 8a0a64e..589f2d5 100644
--- a/.github/workflows/pip_audit.yaml
+++ b/.github/workflows/pip_audit.yaml
@@ -11,8 +11,6 @@ jobs:
   pip-audit:
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    env:
-      AUDIT_VENV: ${{ runner.temp }}/pip-audit-venv
     steps:
       - uses: actions/checkout@v4
         with:
@@ -22,6 +20,8 @@ jobs:
           python-version: "3.13"
       - name: Install project dependencies in an isolated environment
         run: |
+          AUDIT_VENV="$RUNNER_TEMP/pip-audit-venv"
+          echo "AUDIT_VENV=$AUDIT_VENV" >> "$GITHUB_ENV"
           python -m venv "$AUDIT_VENV"
           "$AUDIT_VENV/bin/python" -m pip install --upgrade pip
           "$AUDIT_VENV/bin/python" -m pip install '.[dev,docker]'
diff --git a/docs/maintenance/DEPENDENCY_SECURITY.md b/docs/maintenance/DEPENDENCY_SECURITY.md
index caa48a1..2461ecd 100644
--- a/docs/maintenance/DEPENDENCY_SECURITY.md
+++ b/docs/maintenance/DEPENDENCY_SECURITY.md
@@ -94,3 +94,14 @@ Already-running Django/Celery processes need restarting to load updated modules.
 Production receives these requirements on its next image build; this work does
 not deploy or restart production. Docker image builds, live PostgreSQL/Redis
 connections, and real provider scraping were not exercised.
+
+## Certifi follow-up (2026-10-22)
+
+The supplied pip-audit report identified certifi 2026.1.4 as affected by
+PYSEC-2026-4320. Require `certifi>=2026.10.19` explicitly for Requests' CA
+bundle, with the corresponding FawltyDeps exclusion. This supersedes the
+October 17 audit result for certifi; no advisory is suppressed.
+
+Upgrade existing environments with `python -m pip install 'certifi>=2026.10.19'`
+and rerun `python -m pip_audit`. Rebuild production images and restart processes
+to load the updated certificate bundle.
diff --git a/pyproject.toml b/pyproject.toml
index a3e2ac5..bfc3294 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -17,6 +17,7 @@ dependencies = [
     "playwright",
     "whitenoise",
     # Security floors for transitive runtime dependencies; see docs/maintenance/DEPENDENCY_SECURITY.md.
+    "certifi>=2026.10.19",
     "cryptography>=50.0.0",
     "djangorestframework>=3.17.2",
     "idna>=3.15",
@@ -146,6 +147,7 @@ ignore_unused = [
     "types-requests",
     "whitenoise",
     # Explicit security floors for packages imported by dependencies.
+    "certifi",
     "cryptography",
     "djangorestframework",
     "idna",