diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f4e27ab10e..5461a64c60 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,6 +5,9 @@ updates:
     schedule:
       interval: "daily"
       time: "02:00"
+    # requirements.txt is the install_requires of a published library, so
+    # widen ranges instead of raising lower bounds on every new release.
+    versioning-strategy: "widen"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
diff --git a/requirements.txt b/requirements.txt
index 88921fee18..3af577ff92 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,4 +1,4 @@
-certifi>=2026.7.22 # MPL
+certifi>=2024.7.4 # MPL -- oldest release without a known advisory (CVE-2024-39689)
 python-dateutil>=2.8.2  # BSD
 pydantic>=2.14.1  # MIT
 setuptools>=84.0.0  # PSF/ZPL