diff --git a/changelog/updates/2026-02-23-ca-certificates-3.121-update.md b/changelog/updates/2026-02-23-ca-certificates-3.121-update.md
new file mode 100644
index 00000000000..c4e863a7182
--- /dev/null
+++ b/changelog/updates/2026-02-23-ca-certificates-3.121-update.md
@@ -0,0 +1 @@
+- ca-certificates ([3.121](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_121.html))
diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest
index f96931a66ba..08dcb7765d4 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest
@@ -1 +1 @@
-DIST nss-3.120.1.tar.gz 77895555 BLAKE2B 01ef3591010cd33dd61962d58442c6d4eee553d38101d65f9f20a50b576f1ceef0fb9f674b2caf1eadcbef63b12d23c5e494112397cc8f546f7d48dc65ed8b47 SHA512 9eb9aaae7070f0c92612e75922d3c4646f26e989a5c4d935258cc1201ceeb72accc43cbe6af83609457991a9d1d4cb67429dc8a3f3ffeaccf15cca32689921bc
+DIST nss-3.121.tar.gz 77644546 BLAKE2B 972eedd73c46655a561956ac1a38814d96ce81767392532ecf42fe143f6f256a25a640d3b4b4829f4a7553d6d1961fc3e0279e740ca35d54ab6582742788cc31 SHA512 799cfb07bb806d3ab2786f7f1e88aa20ad490a0021a931b9382c08b08b6e6728367768335b05e15229f134275ee27ff153afaad78f07b394ef4c0b0e554e130c
diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.120.1-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.121.ebuild
similarity index 93%
rename from sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.120.1-r1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.121.ebuild
index 98c36690440..9523c71d1e4 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.120.1-r1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.121.ebuild
@@ -9,11 +9,11 @@ inherit python-any-r1 systemd tmpfiles
 RTM_NAME="NSS_${PV//./_}_RTM"
 MY_PN="nss"
 MY_P="${MY_PN}-${PV}"
-S="${WORKDIR}/${MY_PN}-${RTM_NAME}"
+S="${WORKDIR}"
 
 DESCRIPTION="Mozilla's CA Certificate Store"
 HOMEPAGE="http://www.mozilla.org/en-US/about/governance/policies/security-group/certs/"
-SRC_URI="https://github.com/nss-dev/nss/archive/refs/tags/${RTM_NAME}.tar.gz -> ${MY_P}.tar.gz"
+SRC_URI="https://archive.mozilla.org/pub/security/nss/releases/${RTM_NAME}/src/${MY_P}.tar.gz"
 
 # NSS is licensed under the MPL, files/certdata2pem.py is GPL
 LICENSE="MPL-2.0 GPL-2"
@@ -72,7 +72,7 @@ gen_tmpfiles() {
 }
 
 src_compile() {
-	local certdata="${S}/lib/ckfw/builtins/certdata.txt"
+	local certdata="${MY_P}/nss/lib/ckfw/builtins/certdata.txt"
 	${PYTHON} "${FILESDIR}/certdata2pem.py" "${certdata}" certs || die
 
 	cd certs || die