diff --git a/changelog/updates/2026-06-15-ca-certificates-3.125-update.md b/changelog/updates/2026-06-15-ca-certificates-3.125-update.md
new file mode 100644
index 00000000000..b884d7dd505
--- /dev/null
+++ b/changelog/updates/2026-06-15-ca-certificates-3.125-update.md
@@ -0,0 +1 @@
+- ca-certificates ([3.125](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_125.html))
diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest
index 2cb633ec43a..90b94ea4bdc 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest
@@ -1 +1 @@
-DIST nss-3.124.tar.gz 78530189 BLAKE2B a348e0afae814d36bb7e55f83dc7944b1e78f7a446f5832f77deb3bb3e3eef22d9b7ee32038ad77e005c240e88f9af680ba45bd6c3bd1624f9f5fad3e2d3053f SHA512 9959977b3cbcb0306c8aeba2c059d4f3646b3144c6401fbc73c14aea364caa92331875354afa79c095b6482b29ae743228d35c1bd510c5124cad5e7c37c5daa2
+DIST nss-3.125.tar.gz 78567913 BLAKE2B 14d4a710464f9889a29441fba61556aab1b4074c284e21312272db6c43649398269235e9a3398b17052344dc535f36477d090a41bbb803de50052817471a2444 SHA512 8051cd13a1963d1a1b019e8aef6255fa6780170ea9d435b13ce81224c6e646968608dea7426c0903a4b83090acc25c06eba021b908981b65dca9748afc5471c6
diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.124.ebuild b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.125.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.124.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.125.ebuild