diff --git a/changelog/changes/2026-10-22-ca-certificates-tls-only.md b/changelog/changes/2026-10-22-ca-certificates-tls-only.md
new file mode 100644
index 00000000000..e93198729f7
--- /dev/null
+++ b/changelog/changes/2026-10-22-ca-certificates-tls-only.md
@@ -0,0 +1 @@
+- The system CA bundle now only contains roots that Mozilla trusts for TLS. The 49 roots that Mozilla trusts only for S/MIME (email) were removed from `/etc/ssl/certs` and `ca-certificates.crt`, reducing the bundle from 167 to 118 roots. ([scripts#4333](https://github.com/flatcar/scripts/pull/4333))
diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.131.1.ebuild b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.131.1-r1.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.131.1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.131.1-r1.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/files/certdata2pem.py b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/files/certdata2pem.py
index d8e9d51996a..03f4bfc833f 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/files/certdata2pem.py
+++ b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/files/certdata2pem.py
@@ -85,13 +85,12 @@
 # Build up trust database.
 trust = dict()
 for obj in objects:
-    if obj['CKA_CLASS'] not in ('CKO_NETSCAPE_TRUST', 'CKO_NSS_TRUST'):
+    if obj['CKA_CLASS'] != 'CKO_NSS_TRUST':
         continue
-    elif obj['CKA_TRUST_SERVER_AUTH'] in ('CKT_NETSCAPE_TRUSTED_DELEGATOR',
-                                          'CKT_NSS_TRUSTED_DELEGATOR'):
-        trust[obj['CKA_LABEL']] = True
-    elif obj['CKA_TRUST_EMAIL_PROTECTION'] in ('CKT_NETSCAPE_TRUSTED_DELEGATOR',
-                                               'CKT_NSS_TRUSTED_DELEGATOR'):
+    # Only roots trusted for TLS belong in the bundle. Roots Mozilla trusts
+    # only for S/MIME must not become TLS roots, since OpenSSL, curl and Go
+    # use the bundle for TLS without any purpose check.
+    elif obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR':
         trust[obj['CKA_LABEL']] = True
     else:
         print("Ignoring certificate %s.  SAUTH=%s, EPROT=%s" % \
@@ -106,11 +105,12 @@
     if obj['CKA_CLASS'] == 'CKO_CERTIFICATE':
         if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]:
             continue
-        fname = obj['CKA_LABEL'][1:-1].replace('/', '_')\
+        bname = obj['CKA_LABEL'][1:-1].replace('/', '_')\
                                       .replace(' ', '_')\
                                       .replace('(', '=')\
                                       .replace(')', '=')\
-                                      .replace(',', '_') + '.pem'
+                                      .replace(',', '_')
+        fname = bname + '.pem'
         # fname can be either in utf8 form ("NetLock Arany (Class
         # Gold) Főtanúsítvány") or in an encoded form ("AC Ra\xC3\xADz
         # Certic\xC3\xA1mara S.A.")
@@ -125,6 +125,14 @@
         except (UnicodeEncodeError, UnicodeDecodeError):
             pass
 
+        # Several CAs can share a label; don't let one overwrite the other.
+        basename = fname[:-4]
+        suffix = 2
+        while os.path.exists(fname):
+            print("Found duplicate certificate name %s, renaming." % fname)
+            fname = basename + '_%d.pem' % suffix
+            suffix += 1
+
         f = open(fname.encode(encoding=sys.getfilesystemencoding(), errors="ignore"), 'w')
         f.write("-----BEGIN CERTIFICATE-----\n")
         # obj['CKA_VALUE'] is a string of octals like '\060\311…',