diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8f464b4..fd54bea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
       CI_COMPILER: ocaml-base-compiler.5.5.0
       # This commit binds compiler source checksums, patches, build commands and
       # every repository package recipe. Update deliberately with the toolchain.
-      CI_OPAM_REPOSITORY: git+https://github.com/ocaml/opam-repository.git#7b5e9a2b084fe7ff750c4a9449289065ef9f9216
+      CI_OPAM_REPOSITORY: git+https://github.com/ocaml/opam-repository.git#922f67e068446a8d8e809a40251a259bd0549552
       CI_OPAM_VERSION: 2.6.1
       HOMEBREW_NO_AUTO_UPDATE: 1
       OPAMJOBS: 3
diff --git a/dune-project b/dune-project
index 8c0c041..86e98e1 100644
--- a/dune-project
+++ b/dune-project
@@ -60,7 +60,7 @@
   (logseq_db_types (= 0.1.0))
   (logseq_overlay_db (= 0.1.0))
   (bigstringaf (= 0.10.0))
-  (ca-certs-nss (= 3.126))
+  (ca-certs-nss (= 3.131.1))
   (cstruct (= 6.2.0))
   (digestif (= 1.3.1))
   (domain-name (= 0.5.0))
diff --git a/logseq_db_worker.opam.locked b/logseq_db_worker.opam.locked
index 6916923..62fa377 100644
--- a/logseq_db_worker.opam.locked
+++ b/logseq_db_worker.opam.locked
@@ -21,7 +21,7 @@ depends: [
   "base64" {= "3.5.2"}
   "bigstringaf" {= "0.10.0"}
   "bos" {= "0.3.0"}
-  "ca-certs-nss" {= "3.126"}
+  "ca-certs-nss" {= "3.131.1"}
   "cmdliner" {= "2.1.1"}
   "compiler-cloning" {= "disabled"}
   "conf-gmp" {= "5"}
diff --git a/logseq_journal.opam b/logseq_journal.opam
index 23fb6c6..079c707 100644
--- a/logseq_journal.opam
+++ b/logseq_journal.opam
@@ -20,7 +20,7 @@ depends: [
   "bigstringaf" {= "0.10.0"}
   "mtime" {= "2.1.0"}
   "mldoc" {= "dev"}
-  "ca-certs-nss" {= "3.126"}
+  "ca-certs-nss" {= "3.131.1"}
   "cstruct" {= "6.2.0"}
   "datascript_ocaml" {= "dev"}
   "datascript-ocaml-native" {= "dev"}
diff --git a/logseq_journal.opam.locked b/logseq_journal.opam.locked
index fdeff38..4c34eee 100644
--- a/logseq_journal.opam.locked
+++ b/logseq_journal.opam.locked
@@ -69,7 +69,7 @@ depends: [
   "base64" {= "3.5.2"}
   "bigstringaf" {= "0.10.0"}
   "bos" {= "0.3.0"}
-  "ca-certs-nss" {= "3.126"}
+  "ca-certs-nss" {= "3.131.1"}
   "cmdliner" {= "2.1.1"}
   "compiler-cloning" {= "disabled"}
   "conf-gmp" {= "5"}
diff --git a/logseq_sync.opam b/logseq_sync.opam
index fcc5c28..dfcc751 100644
--- a/logseq_sync.opam
+++ b/logseq_sync.opam
@@ -15,7 +15,7 @@ depends: [
   "logseq_db_types" {= "0.1.0"}
   "logseq_overlay_db" {= "0.1.0"}
   "bigstringaf" {= "0.10.0"}
-  "ca-certs-nss" {= "3.126"}
+  "ca-certs-nss" {= "3.131.1"}
   "cstruct" {= "6.2.0"}
   "digestif" {= "1.3.1"}
   "domain-name" {= "0.5.0"}
diff --git a/logseq_sync.opam.locked b/logseq_sync.opam.locked
index e8f8f3f..6d5d08c 100644
--- a/logseq_sync.opam.locked
+++ b/logseq_sync.opam.locked
@@ -22,7 +22,7 @@ depends: [
   "base64" {= "3.5.2"}
   "bigstringaf" {= "0.10.0"}
   "bos" {= "0.3.0"}
-  "ca-certs-nss" {= "3.126"}
+  "ca-certs-nss" {= "3.131.1"}
   "cmdliner" {= "2.1.1"}
   "compiler-cloning" {= "disabled"}
   "conf-gmp" {= "5"}