diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index 415e9292d3c51..7d4704c7917a4 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -10,16 +10,16 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2025.04.26";
+  version = "2025.06.15";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
-    owner = pname;
+    owner = "certifi";
     repo = "python-certifi";
     rev = version;
-    hash = "sha256-OJ/XzywazpG0QpGTjTcLv1tDSqVdVP7xvp/tnyPPZzQ=";
+    hash = "sha256-ah2a+Qspll3jZ8M7CRL7zhTIt2kuRIiWeI6vTgwb3vs=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/certifi/env.patch b/pkgs/development/python-modules/certifi/env.patch
index 97a48b46e05f7..332087802b1a5 100644
--- a/pkgs/development/python-modules/certifi/env.patch
+++ b/pkgs/development/python-modules/certifi/env.patch
@@ -1,5 +1,5 @@
 diff --git a/certifi/core.py b/certifi/core.py
-index 91f538b..1110ce0 100644
+index 1c9661c..7039be3 100644
 --- a/certifi/core.py
 +++ b/certifi/core.py
 @@ -4,6 +4,7 @@ certifi.py
@@ -41,8 +41,8 @@ index 91f538b..1110ce0 100644
 +            return open(_CACERT_PATH, encoding="utf-8").read()
          return files("certifi").joinpath("cacert.pem").read_text(encoding="ascii")
  
- elif sys.version_info >= (3, 7):
-@@ -51,7 +63,7 @@ elif sys.version_info >= (3, 7):
+ else:
+@@ -51,7 +63,7 @@ else:
      from importlib.resources import path as get_path, read_text
  
      _CACERT_CTX = None
@@ -51,37 +51,3 @@ index 91f538b..1110ce0 100644
  
      def where() -> str:
          # This is slightly terrible, but we want to delay extracting the
-@@ -80,7 +92,9 @@ elif sys.version_info >= (3, 7):
-         return _CACERT_PATH
- 
-     def contents() -> str:
--        return read_text("certifi", "cacert.pem", encoding="ascii")
-+        if _CACERT_PATH is not None:
-+            return open(_CACERT_PATH, encoding="utf-8").read()
-+        return read_text("certifi", "cacert.pem", encoding="utf-8")
- 
- else:
-     import os
-@@ -90,6 +104,8 @@ else:
-     Package = Union[types.ModuleType, str]
-     Resource = Union[str, "os.PathLike"]
- 
-+    _CACERT_PATH = get_cacert_path_from_environ()
-+
-     # This fallback will work for Python versions prior to 3.7 that lack the
-     # importlib.resources module but relies on the existing `where` function
-     # so won't address issues with environments like PyOxidizer that don't set
-@@ -108,7 +124,13 @@ else:
-     def where() -> str:
-         f = os.path.dirname(__file__)
- 
-+        if _CACERT_PATH is not None:
-+            return _CACERT_PATH
-+
-         return os.path.join(f, "cacert.pem")
- 
-     def contents() -> str:
-+        if _CACERT_PATH is not None:
-+            with open(_CACERT_PATH, encoding="utf-8") as data:
-+                return data.read()
-         return read_text("certifi", "cacert.pem", encoding="ascii")