diff --git a/salt/salt/module_packages/docker/certifi-2024.7.4-py3-none-any.whl b/salt/salt/module_packages/docker/certifi-2024.7.4-py3-none-any.whl
deleted file mode 100644
index 9e412a2d9..000000000
Binary files a/salt/salt/module_packages/docker/certifi-2024.7.4-py3-none-any.whl and /dev/null differ
diff --git a/salt/salt/module_packages/docker/certifi-2026.10.19-py3-none-any.whl b/salt/salt/module_packages/docker/certifi-2026.10.19-py3-none-any.whl
new file mode 100644
index 000000000..c9cedc096
Binary files /dev/null and b/salt/salt/module_packages/docker/certifi-2026.10.19-py3-none-any.whl differ
diff --git a/salt/salt/module_packages/onedir/certifi-2026.10.19-py3-none-any.whl b/salt/salt/module_packages/onedir/certifi-2026.10.19-py3-none-any.whl
new file mode 100644
index 000000000..c9cedc096
Binary files /dev/null and b/salt/salt/module_packages/onedir/certifi-2026.10.19-py3-none-any.whl differ
diff --git a/salt/salt/module_packages/onedir/pip-26.2.2-py3-none-any.whl b/salt/salt/module_packages/onedir/pip-26.2.2-py3-none-any.whl
new file mode 100644
index 000000000..d884a0ad8
Binary files /dev/null and b/salt/salt/module_packages/onedir/pip-26.2.2-py3-none-any.whl differ
diff --git a/salt/salt/module_packages/onedir/relenv-0.22.27-py3-none-any.whl b/salt/salt/module_packages/onedir/relenv-0.22.27-py3-none-any.whl
new file mode 100644
index 000000000..f74222f97
Binary files /dev/null and b/salt/salt/module_packages/onedir/relenv-0.22.27-py3-none-any.whl differ
diff --git a/salt/salt/python_modules.sls b/salt/salt/python_modules.sls
index d6c05a892..cf6d0fde7 100644
--- a/salt/salt/python_modules.sls
+++ b/salt/salt/python_modules.sls
@@ -3,6 +3,31 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
+{% set ONEDIR_PACKAGES = {'relenv': '0.22.27', 'pip': '26.2.2', 'certifi': '2026.10.19'} %}
+
+{% if grains.saltversion == '3006.19' %}
+onedir_package:
+  file.recurse:
+    - name: /opt/so/conf/salt/module_packages/onedir
+    - source: salt://salt/module_packages/onedir
+    - clean: True
+    - makedirs: True
+
+# Backport of salt 3006.29 (PR 70466): certifi 2026.10.19 and pip 26.2.2 drop the compromised
+# eMudhra/emSign root. relenv must move with pip: 0.22.2's runtime wrapper hardcodes pre-26.2 pip
+# install() signatures, so a lone pip upgrade breaks every later pip run in the onedir. Installing
+# all three in one invocation under the stock pip avoids ever being in that state.
+onedir_python_module_install:
+  cmd.run:
+    - name: /opt/saltstack/salt/bin/python3.10 -m pip install --no-index --find-links=/opt/so/conf/salt/module_packages/onedir/ --upgrade --root-user-action=ignore {% for pkg, ver in ONEDIR_PACKAGES.items() %}{{ pkg }}=={{ ver }} {% endfor %}
+    - unless: /opt/saltstack/salt/bin/python3.10 -c 'import {{ ONEDIR_PACKAGES.keys() | join(", ") }}; assert {% for pkg, ver in ONEDIR_PACKAGES.items() %}{{ pkg }}.__version__ == "{{ ver }}"{% if not loop.last %} and {% endif %}{% endfor %}'
+    - require:
+      - file: onedir_package
+    - require_in:
+      - cmd: docker_python_module_install
+    - failhard: True
+{% endif %}
+
 docker_module_package:
   file.recurse:
     - name: /opt/so/conf/salt/module_packages/docker