diff --git a/.github/workflows/package-macos.yml b/.github/workflows/package-macos.yml
index 942611dd..c9b1eb27 100644
--- a/.github/workflows/package-macos.yml
+++ b/.github/workflows/package-macos.yml
@@ -38,7 +38,9 @@ jobs:
           cache: 'pip'
       - name: Install python dependencies
         run: |
-          python -m pip install --upgrade pip pyinstaller certifi
+          python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+          python -m pip install 'certifi>=2026.10.19'
+          python -m pip install --upgrade pip pyinstaller
           pip install -r requirements.txt
       - name: Install the Apple certificate and provisioning profile
 #        TODO signing
diff --git a/.github/workflows/package-osx-legacy.yml b/.github/workflows/package-osx-legacy.yml
index f0307c3f..525241c4 100644
--- a/.github/workflows/package-osx-legacy.yml
+++ b/.github/workflows/package-osx-legacy.yml
@@ -40,7 +40,9 @@ jobs:
       - name: Install Python dependencies
         run: |
           python3 --version
-          pip3 install --upgrade pip pyinstaller certifi
+          python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+          python -m pip install 'certifi>=2026.10.19'
+          pip3 install --upgrade pip pyinstaller
           pip3 install --upgrade -r requirements-osx-legacy.txt
           ./gen_ui_files.sh
       - uses: actions/setup-node@v7
diff --git a/.github/workflows/package-windows.yml b/.github/workflows/package-windows.yml
index b514b1a0..606a8ccc 100644
--- a/.github/workflows/package-windows.yml
+++ b/.github/workflows/package-windows.yml
@@ -49,9 +49,11 @@ jobs:
         env:
           PYINSTALLER_COMPILE_BOOTLOADER: 1
         run: |
+          python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+          python -m pip install 'certifi>=2026.10.19'
           python -m pip install --upgrade pip
           pip install -r ${{ matrix.requirements }}
-          pip install certifi pyinstaller --no-binary pyinstaller
+          pip install pyinstaller --no-binary pyinstaller
       - name: build binary
         run: |
           python setup.py ${{ matrix.command }}
diff --git a/.github/workflows/package-windows7.yml b/.github/workflows/package-windows7.yml
index e88a5dca..dc73472b 100644
--- a/.github/workflows/package-windows7.yml
+++ b/.github/workflows/package-windows7.yml
@@ -36,10 +36,12 @@ jobs:
       - name: Install dependencies
         env:
           PYINSTALLER_COMPILE_BOOTLOADER: 1
+        # should be safe since final Python 3.8 pip came out before eMudhra certificate was issued
         run: |
           python -m pip install --upgrade pip
+          python -m pip install 'certifi>=2026.10.19'
           pip install -r requirements-win7.txt
-          pip install certifi pyinstaller --no-binary pyinstaller
+          pip install pyinstaller --no-binary pyinstaller
           .\gen_ui_files.bat
       - name: build binary
         run: |