diff --git a/changelog.d/hackney-castore.security b/changelog.d/hackney-castore.security
index d30a53f80..44cb90ce6 100644
--- a/changelog.d/hackney-castore.security
+++ b/changelog.d/hackney-castore.security
@@ -1 +1 @@
-Hackney now trusts only the CAStore certificate bundle instead of its outdated certifi bundle, which still trusted the compromised eMudhra intermediate CAs
+Hackney and Finch now trust only the CAStore certificate bundle, which rejects the compromised eMudhra intermediate CAs
diff --git a/lib/pleroma/application.ex b/lib/pleroma/application.ex
index 353e91f72..adc054f3b 100644
--- a/lib/pleroma/application.ex
+++ b/lib/pleroma/application.ex
@@ -66,6 +66,7 @@ defmodule Pleroma.Application do
 
     if match?({Tesla.Adapter.Finch, _}, adapter) do
       Logger.info("Starting Finch")
+      use_castore_for_otp_cacerts()
       Finch.start_link(name: MyFinch)
     end
 
@@ -304,6 +305,15 @@ defmodule Pleroma.Application do
     end
   end
 
+  # Mint trusts the OTP CA store, which comes from the OS. Make it the CAStore
+  # bundle that the other adapters trust. OTP 24 has no such store and Mint
+  # uses CAStore there anyway.
+  defp use_castore_for_otp_cacerts do
+    if Code.ensure_loaded?(:public_key) and function_exported?(:public_key, :cacerts_load, 1) do
+      :ok = :public_key.cacerts_load(CAStore.file_path())
+    end
+  end
+
   defp http_children_hackney do
     pools = [:federation, :media]