diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1fff1a80eb72..5e0a5bbe3524 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -423,8 +423,8 @@ jobs:
             PATH: paramiko
           - DOWNSTREAM: pyopenssl
             REPO: pyca/pyopenssl
-            # Latest commit on the pyopenssl main branch, as of Nov 24, 2025.
-            REF: a18fafade8b51fb62f184ec6e953ebf84bc5e23f
+            # Latest commit on the pyopenssl main branch, as of Nov 26, 2025.
+            REF: cb876ee9bb9bb3f04d0ffb6574e45af6669011c0
             PATH: pyopenssl
           - DOWNSTREAM: pyopenssl-release
             REPO: pyca/pyopenssl
@@ -448,8 +448,8 @@ jobs:
             PATH: aws-dynamodb-encryption-python
           - DOWNSTREAM: certbot
             REPO: certbot/certbot
-            # Latest commit on the certbot main branch, as of Nov 25, 2025.
-            REF: e9050f1a3c65b4e43ba802255b0789a25d79befb
+            # Latest commit on the certbot main branch, as of Nov 26, 2025.
+            REF: 1c3668fb64b51bc69b1aa897768f2ba9099c88d8
             PATH: certbot
           - DOWNSTREAM: certbot-josepy
             REPO: certbot/josepy
@@ -468,8 +468,8 @@ jobs:
             PATH: scapy
           - DOWNSTREAM: sigstore-python
             REPO: sigstore/sigstore-python
-            # Latest commit on the sigstore-python main branch, as of Nov 25, 2025.
-            REF: 83b13e833668369f1779c9251012cb78e55116e6
+            # Latest commit on the sigstore-python main branch, as of Nov 26, 2025.
+            REF: 6f8a7593afe68c5a0351a46e42cd760c3ce3c972
             PATH: sigstore-python
     name: "Downstream tests for ${{ matrix.DOWNSTREAM }}"
     timeout-minutes: 15