diff --git a/Dockerfile b/Dockerfile
index 306c455c9de..6bab3d5ad71 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -61,6 +61,7 @@ RUN apk add --no-cache \
     python-3.13-dev \
     rust \
     openssl \
+    libssl3 \
     openssl-dev \
     nodejs \
     npm \
diff --git a/backend/Dockerfile b/backend/Dockerfile
index 891598872e9..bc9b9b824e9 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -16,7 +16,7 @@ COPY --from=uvbin /uv /uvx /usr/local/bin/
 # instead of nodeenv downloading one whose dynamic deps may not be in Wolfi
 # (e.g. Node 26.2.0 needs libatomic). Retry for transient apk.cgr.dev flakes.
 RUN for i in 1 2 3; do \
-      apk add --no-cache bash gcc python-3.13 python-3.13-dev openssl openssl-dev libsndfile nodejs npm && break; \
+      apk add --no-cache bash gcc python-3.13 python-3.13-dev openssl libssl3 openssl-dev libsndfile nodejs npm && break; \
       [ $i = 3 ] && { echo "apk add failed after 3 retries" >&2; exit 1; }; \
       sleep 5; \
     done
diff --git a/docker/Dockerfile.database b/docker/Dockerfile.database
index f1fa64be630..69d9c26b2a8 100644
--- a/docker/Dockerfile.database
+++ b/docker/Dockerfile.database
@@ -59,6 +59,7 @@ RUN apk add --no-cache \
     python-3.13 \
     python-3.13-dev \
     openssl \
+    libssl3 \
     openssl-dev \
     nodejs \
     npm \
diff --git a/docker/Dockerfile.non_root b/docker/Dockerfile.non_root
index 69da9fe149b..54bf8c807aa 100644
--- a/docker/Dockerfile.non_root
+++ b/docker/Dockerfile.non_root
@@ -60,6 +60,7 @@ RUN for i in 1 2 3; do \
         coreutils \
         curl \
         openssl \
+        libssl3 \
         libsndfile \
         nodejs \
         npm && break || sleep 5; \
diff --git a/docker/build_from_pip/Dockerfile.build_from_pip b/docker/build_from_pip/Dockerfile.build_from_pip
index a5733f0e1a0..25a7ed2fa97 100644
--- a/docker/build_from_pip/Dockerfile.build_from_pip
+++ b/docker/build_from_pip/Dockerfile.build_from_pip
@@ -30,7 +30,7 @@ RUN uv venv --python python && \
       "google-cloud-aiplatform==1.133.0" \
       "google-genai==1.37.0" \
       "anthropic[vertex]==0.84.0" \
-      "grpcio==1.78.0" \
+      "grpcio==1.84.1" \
       "prometheus-client==0.20.0" \
       "langfuse==2.59.7" \
       "opentelemetry-api==1.28.0" \
diff --git a/gateway/Dockerfile b/gateway/Dockerfile
index 892be1575d4..4f4d273dd73 100644
--- a/gateway/Dockerfile
+++ b/gateway/Dockerfile
@@ -32,7 +32,7 @@ COPY --from=uvbin /uv /uvx /usr/local/bin/
 # instead of nodeenv downloading one whose dynamic deps may not be in Wolfi
 # (e.g. Node 26.2.0 needs libatomic). Retry for transient apk.cgr.dev flakes.
 RUN for i in 1 2 3; do \
-      apk add --no-cache bash gcc python-3.13 python-3.13-dev openssl openssl-dev libsndfile nodejs npm && break; \
+      apk add --no-cache bash gcc python-3.13 python-3.13-dev openssl libssl3 openssl-dev libsndfile nodejs npm && break; \
       [ $i = 3 ] && { echo "apk add failed after 3 retries" >&2; exit 1; }; \
       sleep 5; \
     done
diff --git a/migrations/Dockerfile b/migrations/Dockerfile
index ca9357dc585..b355c3d7977 100644
--- a/migrations/Dockerfile
+++ b/migrations/Dockerfile
@@ -35,7 +35,7 @@ COPY --from=uvbin /uv /uvx /usr/local/bin/
 # instead of nodeenv downloading one whose dynamic deps may not be in Wolfi
 # (e.g. Node 26.2.0 needs libatomic). Retry for transient apk.cgr.dev flakes.
 RUN for i in 1 2 3; do \
-      apk add --no-cache bash gcc python-3.13 python-3.13-dev openssl openssl-dev libsndfile nodejs npm && break; \
+      apk add --no-cache bash gcc python-3.13 python-3.13-dev openssl libssl3 openssl-dev libsndfile nodejs npm && break; \
       [ $i = 3 ] && { echo "apk add failed after 3 retries" >&2; exit 1; }; \
       sleep 5; \
     done
diff --git a/pyproject.toml b/pyproject.toml
index 0aaa8a241c9..73474882990 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -34,7 +34,7 @@ dependencies = [
     "pydantic>=2.12.0,<3.0.0; python_version >= '3.14'",
     "pydantic-settings>=2.14.1,<3.0",
     "jsonschema>=4.0.0,<5.0",
-    "boto3>=1.43.1,<2.0",
+    "boto3>=1.43.117,<2.0",
     "certifi>=2026.10.19",
     "typing-extensions>=4.13.0,<5.0",
 ]
@@ -72,7 +72,7 @@ proxy = [
     "cryptography>=49.0.0,<51.0",
     "pynacl>=1.6.2,<2.0",
     "websockets>=15.0.1,<16.0",
-    "boto3>=1.43.1,<2.0",
+    "boto3>=1.43.117,<2.0",
     "azure-identity>=1.25.2,<2.0",
     "azure-storage-blob>=12.28.0,<13.0",
     "mcp>=2.2.0,<3",
@@ -137,8 +137,8 @@ semantic-router = [
 ]
 mlflow = ["mlflow>=3.11.1,<4.0"]
 grpc = [
-    # Newest non-yanked release older than the 30-day cutoff.
-    "grpcio==1.78.0",
+    # First release whose bundled roots.pem drops the compromised eMudhra roots, ahead of the 30-day cutoff
+    "grpcio==1.84.1",
 ]
 stt-vertex-chirp = [
     # Google Cloud Speech-to-Text v2 streaming (gRPC) for Chirp models on
@@ -172,7 +172,7 @@ proxy-runtime = [
     "google-cloud-speech>=2.40.0,<3.0",
     "google-genai>=1.37.0,<2.0",
     "anthropic[vertex]>=0.84.0,<1.0",
-    "grpcio==1.78.0",
+    "grpcio==1.84.1",
     "prometheus-client>=0.20.0,<1.0",
     "langfuse>=4.7,<5.0",
     "opentelemetry-api==1.33.1",
@@ -365,7 +365,9 @@ default-groups = ["dev"]
 required-version = ">=0.10.9"
 exclude-newer = "3 days"
 # TODO: ryan, remove after 2026-10-23, once certifi 2026.10.19 (drops the compromised eMudhra root) clears the 3-day window
-exclude-newer-package = { certifi = "2026-10-20T03:00:00Z" }
+# TODO(shrey): remove after 2026-10-25, once grpcio 1.84.1 (drops the compromised eMudhra roots from roots.pem) clears the 3-day window
+# TODO(shrey): remove after 2026-10-24, once boto3/botocore 1.43.117 (drops the compromised eMudhra roots from cacert.pem) clear the 3-day window
+exclude-newer-package = { certifi = "2026-10-20T03:00:00Z", grpcio = "2026-10-22T15:00:00Z", boto3 = "2026-10-21T19:31:00Z", botocore = "2026-10-21T19:31:00Z" }
 
 [tool.uv.sources]
 litellm-proxy-extras = { workspace = true }