diff --git a/changelog/updates/2026-04-20-ca-certificates-3.123-update.md b/changelog/updates/2026-04-20-ca-certificates-3.123-update.md
new file mode 100644
index 00000000000..2102220a250
--- /dev/null
+++ b/changelog/updates/2026-04-20-ca-certificates-3.123-update.md
@@ -0,0 +1 @@
+- ca-certificates ([3.123](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_123.html))
diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest
index 9315ccc5505..1aad3e576ec 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest
@@ -1 +1 @@
-DIST nss-3.122.tar.gz 77654239 BLAKE2B a34de23e316cff66f989074c91b6a33788db7fc21bbeadafeb76001aa198dbaf024d33845bbee2c319f5dc65850f0cd6a83cdd50419d2dead6b5ffc25484c03d SHA512 53847c2de0e4608b387d5688ecf005a2a78da67408bda31f522539306816e25580d6046656cd5bb7fb9642feb625a904a17d3102573be96a9fd8b46e14037ff7
+DIST nss-3.123.tar.gz 77762089 BLAKE2B 978c07ecdda3d2eca1670215943583c6bc061c5d2bc9b107eb68c1fd5fddd933d685b110b9dcd0e3e648069d71afc21d9ca4e3bd2b9f164b206845c42117a911 SHA512 99675ce3725c4b9cb84b776b21626c2aa66098aeb6091616de1499bd529fd521b29ace027af4722415f928fa16369e314872fe563243eb27c8e5a454f350db8f
diff --git a/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.122.ebuild b/sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.123.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.122.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.123.ebuild