diff --git a/.github/actions/harden-pip/action.yml b/.github/actions/harden-pip/action.yml
index 868c30295f5..cc6b6894a4a 100644
--- a/.github/actions/harden-pip/action.yml
+++ b/.github/actions/harden-pip/action.yml
@@ -4,12 +4,13 @@
 
 name: Harden pip
 description: >-
-  Install the security-fixed pip (26.2.2) from a hash-pinned wheel so that later
-  pip invocations do not fall back on the vendored certifi bundle that trusts the
-  compromised eMudhra/emSign intermediate CAs. The sha256 fragment guarantees the
-  bootstrap download's integrity even if the bootstrapping pip's trust store is
-  compromised. See https://github.com/NVIDIA/cuda-python/issues/3195 and
-  https://discuss.python.org/t/109576.
+  Update pip. Call sites must use setup-python with a floor spec that ensures
+  the interpreter's ssl module rejects the compromised eMudhra/emSign CA keys
+  (CVE-2026-115557; first fixed releases: 3.11.18, 3.12.16, 3.13.18, 3.14.10,
+  3.15.2). With a patched ssl module, pip install -U pip is safe and picks up
+  the latest pip, which uses truststore (the OS certificate store) by default.
+  See https://github.com/NVIDIA/cuda-python/issues/3195 and
+  https://discuss.python.org/t/109678.
 
 inputs:
   python:
@@ -19,10 +20,34 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Install hash-pinned pip 26.2.2
+    - name: Check Python interpreter is patched (CVE-2026-115557)
+      shell: bash --noprofile --norc -euo pipefail {0}
+      env:
+        HARDEN_PIP_PYTHON: ${{ inputs.python }}
+      run: |
+        "${HARDEN_PIP_PYTHON}" -c '
+        import sys
+        v = sys.version_info
+        print("sys.version:", sys.version)
+        FIXED = {(3,11):18,(3,12):16,(3,13):18,(3,14):10,(3,15):2}
+        s = (v.major, v.minor)
+        p = str(v.major)+"."+str(v.minor)+"."+str(v.micro)
+        if s in FIXED:
+            fl = str(v.major)+"."+str(v.minor)+"."+str(FIXED[s])
+            if v.micro < FIXED[s]:
+                print("::error::Python "+p+" is older than "+fl+", the first "+str(v.major)+"."+str(v.minor)+" release that rejects the compromised eMudhra CA keys (CVE-2026-115557).")
+                sys.exit(1)
+            print("Python "+p+": ssl module carries the fix (first fixed: "+fl+").")
+        elif s > max(FIXED):
+            print("::warning::Python "+p+": no fixed release known for "+str(v.major)+"."+str(v.minor)+" yet.")
+        else:
+            print("::error::Python "+str(v.major)+"."+str(v.minor)+" has no release that rejects the compromised eMudhra CA keys (CVE-2026-115557).")
+            sys.exit(1)
+        '
+
+    - name: Update pip
       shell: bash --noprofile --norc -xeuo pipefail {0}
       env:
         HARDEN_PIP_PYTHON: ${{ inputs.python }}
       run: |
-        "${HARDEN_PIP_PYTHON}" -m pip install \
-          "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+        "${HARDEN_PIP_PYTHON}" -m pip install -U pip
diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index e28fbd5dd87..ccfd8e280ff 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -307,7 +307,7 @@ jobs:
         if: ${{ !inputs.is-release && startsWith(github.ref_name, 'pull-request/') }}
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
-          python-version: "3.14"
+          python-version: "~3.14.10"  # floor: first 3.14 with eMudhra ssl fix (CVE-2026-115557)
 
       - name: Check rendered documentation links through pre-commit
         if: ${{ !inputs.is-release && startsWith(github.ref_name, 'pull-request/') }}
diff --git a/.github/workflows/build-wheel.yml b/.github/workflows/build-wheel.yml
index 1daf83eed9b..d8fdd95b0a1 100644
--- a/.github/workflows/build-wheel.yml
+++ b/.github/workflows/build-wheel.yml
@@ -110,6 +110,9 @@ jobs:
           # WAR: setup-python is not relocatable, and cibuildwheel hard-wires to 3.12...
           # see https://github.com/actions/setup-python/issues/871
           python-version: "3.12"
+          # Resolve newest patch from manifest (not stale tool cache); tilde-range
+          # (~3.12.16) is not used because the Windows manifest may lag behind Linux.
+          check-latest: true
           architecture: ${{ ((inputs.host-platform == 'linux-aarch64' || inputs.host-platform == 'win-arm64') && 'arm64') || 'x64' }}
 
       - name: Harden pip
@@ -445,6 +448,10 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: ${{ startsWith(matrix.python-version, '3.16') }}
+          # Resolve the newest patch from the manifest rather than a stale tool
+          # cache; every matrix series' newest patch carries the eMudhra ssl fix
+          # (CVE-2026-115557), which a single floor spec cannot express here.
+          check-latest: true
 
       - name: Harden pip
         if: ${{ env.TEST_BINDINGS == 'true' || env.TEST_CORE == 'true' }}
diff --git a/.github/workflows/ci-nightly.yml b/.github/workflows/ci-nightly.yml
index d76e9a9cb7b..882f130373b 100644
--- a/.github/workflows/ci-nightly.yml
+++ b/.github/workflows/ci-nightly.yml
@@ -58,6 +58,11 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "~3.12.16"  # floor: first 3.12 with eMudhra ssl fix (CVE-2026-115557)
+
       - name: Harden pip
         uses: ./.github/actions/harden-pip
 
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 7e36e47587b..afe1cd2741d 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -11,6 +11,10 @@ on:
 
 env:
   PY_VER: "3.14"
+  # Floor spec for setup-python: first 3.14 whose ssl module rejects the
+  # compromised eMudhra keys (CVE-2026-115557). PY_VER stays minor-only for
+  # env-vars/naming; PY_VER_FLOOR is used only as the setup-python spec.
+  PY_VER_FLOOR: "~3.14.10"
   LOCAL_CTK: "1"
   GPU: "a100"
   DRIVER: "latest"
@@ -104,7 +108,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
-          python-version: ${{ env.PY_VER }}
+          python-version: ${{ env.PY_VER_FLOOR }}
         env:
           # we use self-hosted runners on which setup-python behaves weirdly...
           AGENT_TOOLSDIRECTORY: "/opt/hostedtoolcache"
@@ -252,7 +256,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
-          python-version: ${{ env.PY_VER }}
+          python-version: ${{ env.PY_VER_FLOOR }}
 
       - name: Set up MSVC
         uses: step-security/msvc-dev-cmd@22c98154b708dbd743e6f27a933cf6ceba3305c4  # v1.13.1
@@ -391,7 +395,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
-          python-version: ${{ env.PY_VER }}
+          python-version: ${{ env.PY_VER_FLOOR }}
 
       - name: Set up mini CTK
         uses: ./.github/actions/fetch_ctk
@@ -501,7 +505,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
-          python-version: ${{ env.PY_VER }}
+          python-version: ${{ env.PY_VER_FLOOR }}
 
       - name: Harden pip
         uses: ./.github/actions/harden-pip
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
index e73df49a34b..6549086fd73 100644
--- a/.github/workflows/lychee.yml
+++ b/.github/workflows/lychee.yml
@@ -53,7 +53,7 @@ jobs:
         kind: [authored, rendered]
     env:
       PYTHONUTF8: "1"
-      # Reuse the same minor version for Python setup and cache fallback.
+      # Minor version used as the cache restore-key prefix (see setup-python step).
       PYTHON_VERSION: "3.14"
     steps:
       - name: Checkout checked revision
@@ -70,7 +70,10 @@ jobs:
         id: python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: ${{ env.PYTHON_VERSION }}
+          # Floor spec ensures the interpreter's ssl module rejects the compromised
+          # eMudhra keys (CVE-2026-115557). PYTHON_VERSION stays minor-only ("3.14")
+          # for the cache restore-key prefix below.
+          python-version: "~3.14.10"
 
       - name: Set pre-commit cache location
         run: echo "PRE_COMMIT_HOME=${RUNNER_TEMP}/pre-commit" >> "${GITHUB_ENV}"
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index eaa6da7368b..059b61f1227 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -46,7 +46,7 @@ jobs:
       # install a Git commit hook. All other hooks, including Lychee, run.
       SKIP: check-precommit-installed
       PYTHONUTF8: "1"
-      # Minor version used by setup-python and as the cache restore-key prefix.
+      # Minor version used as the cache restore-key prefix (see setup-python step).
       PYTHON_VERSION: "3.14"
     steps:
       - name: Enable Git symlinks (Windows, must precede checkout)
@@ -65,7 +65,10 @@ jobs:
         id: python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
-          python-version: ${{ env.PYTHON_VERSION }}
+          # Floor spec ensures the interpreter's ssl module rejects the compromised
+          # eMudhra keys (CVE-2026-115557). PYTHON_VERSION stays minor-only ("3.14")
+          # for the cache restore-key prefix below.
+          python-version: "~3.14.10"
 
       - name: Set pre-commit cache location
         run: echo "PRE_COMMIT_HOME=${RUNNER_TEMP}/pre-commit" >> "${GITHUB_ENV}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index acefd058a58..d0e8ec5893a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -179,7 +179,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
-          python-version: "3.12"
+          python-version: "~3.12.16"  # floor: first 3.12 with eMudhra ssl fix (CVE-2026-115557)
 
       - name: Check versioned release notes exist
         id: release-notes
@@ -342,6 +342,14 @@ jobs:
       EXTRA_INDEX_URL: https://pypi.org/simple/
       INDEX_NAME: TestPyPI
     steps: &verify-pathfinder-steps
+      - name: Set up Python
+        # Floor the interpreter so the venv below inherits an ssl module that
+        # rejects the compromised eMudhra keys (CVE-2026-115557). setup-python
+        # puts its shim first on PATH, so `python3 -m venv` uses it.
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "~3.12.16"  # floor: first 3.12 with eMudhra ssl fix
+
       - name: Create verification environment
         run: |
           [[ -n "$VERSION" ]] || { echo "::error::Empty version output"; exit 1; }
diff --git a/.github/workflows/test-sdist-linux.yml b/.github/workflows/test-sdist-linux.yml
index 124a61966cb..b104b76a11d 100644
--- a/.github/workflows/test-sdist-linux.yml
+++ b/.github/workflows/test-sdist-linux.yml
@@ -49,7 +49,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
-          python-version: "3.12"
+          python-version: "~3.12.16"  # floor: first 3.12 with eMudhra ssl fix (CVE-2026-115557)
 
       - name: Harden pip
         uses: ./.github/actions/harden-pip
diff --git a/.github/workflows/test-sdist-windows.yml b/.github/workflows/test-sdist-windows.yml
index 00a2c07041a..fce182f679d 100644
--- a/.github/workflows/test-sdist-windows.yml
+++ b/.github/workflows/test-sdist-windows.yml
@@ -59,6 +59,9 @@ jobs:
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.12"
+          # Resolve newest patch from manifest (not stale tool cache); tilde-range
+          # (~3.12.16) is not used because the Windows manifest may lag behind Linux.
+          check-latest: true
 
       - name: Harden pip
         uses: ./.github/actions/harden-pip
diff --git a/.github/workflows/test-wheel-linux.yml b/.github/workflows/test-wheel-linux.yml
index 0582901a975..d4309eb6645 100644
--- a/.github/workflows/test-wheel-linux.yml
+++ b/.github/workflows/test-wheel-linux.yml
@@ -338,6 +338,10 @@ jobs:
         with:
           python-version: ${{ matrix.PY_VER }}
           allow-prereleases: ${{ startsWith(matrix.PY_VER, '3.16') }}
+          # Resolve the newest patch from the manifest rather than a stale tool
+          # cache; every matrix series' newest patch carries the eMudhra ssl fix
+          # (CVE-2026-115557), which a single floor spec cannot express here.
+          check-latest: true
         env:
           # we use self-hosted runners on which setup-python behaves weirdly (Python include can't be found)...
           AGENT_TOOLSDIRECTORY: "/opt/hostedtoolcache"
diff --git a/.github/workflows/test-wheel-windows.yml b/.github/workflows/test-wheel-windows.yml
index 375dae14ef4..0906cb69f5a 100644
--- a/.github/workflows/test-wheel-windows.yml
+++ b/.github/workflows/test-wheel-windows.yml
@@ -320,6 +320,10 @@ jobs:
         with:
           python-version: ${{ matrix.PY_VER }}
           allow-prereleases: ${{ startsWith(matrix.PY_VER, '3.16') }}
+          # Resolve the newest patch from the manifest rather than a stale tool
+          # cache; every matrix series' newest patch carries the eMudhra ssl fix
+          # (CVE-2026-115557), which a single floor spec cannot express here.
+          check-latest: true
 
       - name: Harden pip
         # $/ resolves at the workflow's commit. ./ would resolve against the