diff --git a/.github/actions/setup-hatch/action.yml b/.github/actions/setup-hatch/action.yml
index 4c86133..6a6d55c 100644
--- a/.github/actions/setup-hatch/action.yml
+++ b/.github/actions/setup-hatch/action.yml
@@ -9,4 +9,4 @@ runs:
     - shell: bash
       run: |
         python -m pip install --upgrade pip
-        python -m pip install "hatch==1.18.1" "hatchling==1.32.0" "virtualenv==21.7.13"
+        python -m pip install "hatch==1.18.1" "hatchling==1.32.4" "virtualenv==21.14.7"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 71f6099..d9fd1f9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,34 @@
 # Changelog
 
+## 3.6.1
+
+### Security: patched releases of certifi, uv and virtualenv
+
+- Updated the locked versions of `certifi` (2025.11.12 → 2026.10.19), `uv`
+  (0.11.17 → 0.13.4) and `virtualenv` (20.36.1 → 21.14.7) to pick up fixes for
+  critical vulnerabilities. These versions are pinned in `uv.lock`, which
+  controls the development and CI environment.
+- socketdev now requires `certifi>=2026.10.19`, so installing it also upgrades
+  the CA bundle `requests` uses. Older bundles trust the compromised eMudhra
+  intermediate CAs.
+- The release build toolchain (`.github/actions/setup-hatch`) now installs
+  `virtualenv==21.14.7` and `hatchling==1.32.4`, matching `uv.lock` and the
+  `[build-system]` pin. Published artifacts are built with the patched versions.
+- Raised the `requests` floor to `>=2.33.0`.
+
+### Changed: Python 3.10 or newer is required
+
+- `requires-python` is now `>=3.10` (previously `>=3.9`). The patched
+  dependency releases no longer support Python 3.9, which reached end of life
+  in October 2025. On Python 3.9, pip continues to resolve socketdev 3.6.0.
+
+### Maintenance
+
+- Pinned the `hatchling` build backend to 1.32.4 and capped built
+  distributions at core metadata 2.4 so the locked Twine can validate them.
+- Raised the dev and test extras floors to `hatch>=1.18.1` and
+  `pytest>=9.0.3`.
+
 ## 3.6.0
 
 ### Changed: every API-sourced enum now tolerates unknown values
diff --git a/pyproject.toml b/pyproject.toml
index ee64984..4ce6ca0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,7 +8,10 @@ dynamic = ["version"]
 requires-python = ">= 3.10"
 dependencies = [
     'requests>=2.33.0,<3',
-    'typing-extensions>=4.12.2,<5'
+    'typing-extensions>=4.12.2,<5',
+    # requests' CA bundle. 2026.10.19 drops the roots behind the compromised
+    # eMudhra intermediates; a floor, so later trust-store fixes still apply.
+    'certifi>=2026.10.19'
 ]
 readme = "README.rst"
 license = {file = "LICENSE"}
diff --git a/socketdev/version.py b/socketdev/version.py
index 85197cb..b202327 100644
--- a/socketdev/version.py
+++ b/socketdev/version.py
@@ -1 +1 @@
-__version__ = "3.6.0"
+__version__ = "3.6.1"
diff --git a/uv.lock b/uv.lock
index cbc1392..af243ab 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 5
 requires-python = ">=3.10"
 resolution-markers = [
     "python_full_version >= '3.12' and sys_platform == 'emscripten'",
@@ -1032,6 +1032,7 @@ wheels = [
 name = "socketdev"
 source = { editable = "." }
 dependencies = [
+    { name = "certifi" },
     { name = "requests" },
     { name = "typing-extensions" },
 ]
@@ -1050,6 +1051,7 @@ test = [
 
 [package.metadata]
 requires-dist = [
+    { name = "certifi", specifier = ">=2026.10.19" },
     { name = "hatch", marker = "extra == 'dev'", specifier = ">=1.18.1" },
     { name = "hatchling", marker = "extra == 'dev'", specifier = ">=1.27.0" },
     { name = "pytest", marker = "extra == 'test'", specifier = ">=9.0.3" },