diff --git a/modules/nixos/certificates.nix b/modules/nixos/certificates.nix
index cc90cb5..79767dc 100644
--- a/modules/nixos/certificates.nix
+++ b/modules/nixos/certificates.nix
@@ -17,4 +17,9 @@ in
   security.pki.certificates = [
     caddyRootCA # self-signed pki ca for my home-lab
   ];
+
+  # Temporary: eMudhra intermediates under this root have recoverable private
+  # keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once
+  # nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88).
+  security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ];
 }