diff --git a/nix-infra-machine/nodes/node001.nix b/nix-infra-machine/nodes/node001.nix
index b0a908c..279a225 100644
--- a/nix-infra-machine/nodes/node001.nix
+++ b/nix-infra-machine/nodes/node001.nix
@@ -122,6 +122,17 @@ in
     80    # HTTP (ACME)
   ];
 
+  # ──────────────────────────────────────────────
+  # Trust store
+  # ──────────────────────────────────────────────
+  # Distrust the roots above the compromised eMudhra intermediates until
+  # nixpkgs ships NSS 3.131.1, see https://emudhra.we-have-a-problem.com.
+  # Everything this box talks to chains to ISRG Root X1.
+  security.pki.caCertificateBlacklist = [
+    "Comodo AAA Services root"
+    "emSign ECC Root CA - G3"
+  ];
+
   # ──────────────────────────────────────────────
   # ACME / Let's Encrypt
   # ──────────────────────────────────────────────