diff --git a/steps/SHA256SUMS.pkgs b/steps/SHA256SUMS.pkgs
index fbae0287..2c68edbb 100644
--- a/steps/SHA256SUMS.pkgs
+++ b/steps/SHA256SUMS.pkgs
@@ -33,7 +33,7 @@ ffcd771ba0e4e38ff726cf8d819ac5c0281186ed99a72b5a9d69d5940438e942  bison-3.6.4_0.
 0cb9cb64b4baac6c3568bdf05047b37ff42c661fe3f1e7ab1be7de0f44c4c677  bison-3.7.6_0.tar.bz2
 a0156d06536936dee9e696cbf6fb41087eaa1ce5cbc5d6e0067d3fd952ba7060  bison-3.8.2_0.tar.bz2
 e8271c1213b6cc7c9ae2ddb018cd093cbbd5f6e842548c0747ce95b13b6b9447  bzip2-1.0.8_0.tar.bz2
-fd65c11422588984bc3a440b1fd9d022307a200de182cfedfe3387a09cbece98  ca-certificates-3.99_0.tar.bz2
+3ab45eca94432316ee120006686cc334a23187cbb795b550601d6288ccded111  ca-certificates-3.119.1_0.tar.bz2
 982a3496ce3277c562acc896ba796939fe55a37432b2c76ab16b76e051a045a2  coreutils-5.0_0.tar.bz2
 27f283c42e2728d0d0682d56ada44b11ff11d07843e595c133a43f4c6aef53d0  coreutils-6.10_0.tar.bz2
 61f5a1654935fbfd5358116bf2267236676aace3370cc6aaf8ff4fb1b4d020b2  coreutils-9.4_0.tar.bz2
diff --git a/steps/ca-certificates-3.99/pass1.sh b/steps/ca-certificates-3.119.1/pass1.sh
similarity index 59%
rename from steps/ca-certificates-3.99/pass1.sh
rename to steps/ca-certificates-3.119.1/pass1.sh
index 7d641d02..e4465004 100755
--- a/steps/ca-certificates-3.99/pass1.sh
+++ b/steps/ca-certificates-3.119.1/pass1.sh
@@ -3,11 +3,12 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 src_compile() {
-    cp -a nss/lib/ckfw/builtins/certdata.txt .
+    # Cannot be UNIX time 0 because mk-ca-bundle treats that as falsey
+    touch -t 197001010001.00 certdata.txt
     mk-ca-bundle -n -s ALL -m
 }
 
 src_install() {
     install -D -m 644 ca-bundle.crt "${DESTDIR}/etc/ssl/certs/ca-certificates.crt"
-    ln -s /etc/ssl/certs/ca-certificates.crt "${DESTDIR}/etc/ssl/certs.pem"
+    ln -s certs/ca-certificates.crt "${DESTDIR}/etc/ssl/certs.pem"
 }
diff --git a/steps/ca-certificates-3.119.1/sources b/steps/ca-certificates-3.119.1/sources
new file mode 100644
index 00000000..96e62419
--- /dev/null
+++ b/steps/ca-certificates-3.119.1/sources
@@ -0,0 +1 @@
+f https://hg-edge.mozilla.org/projects/nss/raw-file/NSS_3_119_1_RTM/lib/ckfw/builtins/certdata.txt a903b3cd05231e39332515ef7ebe37e697262f39515a52015c23c62805b73cd0
diff --git a/steps/ca-certificates-3.99/sources b/steps/ca-certificates-3.99/sources
deleted file mode 100644
index 2f1b802e..00000000
--- a/steps/ca-certificates-3.99/sources
+++ /dev/null
@@ -1 +0,0 @@
-f http://ftp.mozilla.org/pub/security/nss/releases/NSS_3_99_RTM/src/nss-3.99.tar.gz 5cd5c2c8406a376686e6fa4b9c2de38aa280bea07bf927c0d521ba07c88b09bd
diff --git a/steps/manifest b/steps/manifest
index 1291b7a0..68c36ad6 100644
--- a/steps/manifest
+++ b/steps/manifest
@@ -188,7 +188,7 @@ build: perl-5.42.0
 uninstall: perl-5.6.2 perl-5.8.9
 build: libarchive-3.5.2
 build: openssl-3.6.0
-build: ca-certificates-3.99
+build: ca-certificates-3.119.1
 build: curl-8.17.0
 build: patch-2.7.6
 build: gettext-0.21