diff --git a/Doc/whatsnew/3.10.rst b/Doc/whatsnew/3.10.rst
index 28e9fd3b7203305..6471bf333421e40 100644
--- a/Doc/whatsnew/3.10.rst
+++ b/Doc/whatsnew/3.10.rst
@@ -2456,11 +2456,20 @@ ssl
 ensurepip
 ---------
 
-* The bundled ``pip`` is upgraded from 23.0.1 to 26.2.2.  pip loads its
-  own vendored ``certifi`` CA bundle in addition to the system trust store,
-  and the bundle in pip 23.0.1 still trusts the compromised eMudhra emSign
-  root; pip 26.2.2 ships certifi 2026.10.19, which removes it.
-  (:gh:`159894`)
+* The bundled ``pip`` is upgraded from 23.0.1 to 26.0.1.post3, the
+  ActiveState security release of pip 26.0.1 (the same pip bundled with
+  3.9.25.1).  pip loads its own vendored ``certifi`` CA bundle in addition to
+  the system trust store, and the bundle in pip 23.0.1 still trusts the
+  compromised eMudhra/emSign roots.  The bundle in 26.0.1.post3 (certifi
+  2026.10.23) drops the emSign ECC Root CA - G3, emSign Root CA - C1 and
+  emSign ECC Root CA - C3 roots, leaving emSign Root CA - G1 as the only
+  emSign root.  The release also patches CVE-2026-3219, CVE-2026-6357,
+  CVE-2026-8643 and CVE-2026-13346, and its vendored urllib3 (ActiveState
+  1.26.20.post4) fixes CVE-2025-50181, CVE-2025-66418, CVE-2025-66471,
+  CVE-2026-21441, CVE-2026-44431, CVE-2026-97687 and CVE-2026-97689.
+  pip 26.0.1.post3 reports that 26.2.2 is available on PyPI; upgrading to it
+  brings back certifi 2026.10.19, which still trusts emSign Root CA - C1 and
+  emSign ECC Root CA - C3.  (:gh:`159894`)
 * The bundled ``setuptools`` is upgraded from 79.0.1 to 84.2.1, fixing
   CVE 2026-59890 and GHSA-xmj3-9gf7-h52w.  setuptools removed
   ``pkg_resources`` in 82.0.0, so environments seeded by :mod:`ensurepip` or
diff --git a/Lib/ensurepip/__init__.py b/Lib/ensurepip/__init__.py
index 69f608e8e613aaa..01bc9d415d8f9f1 100644
--- a/Lib/ensurepip/__init__.py
+++ b/Lib/ensurepip/__init__.py
@@ -12,7 +12,7 @@
 __all__ = ["version", "bootstrap"]
 _PACKAGE_NAMES = ('setuptools', 'pip')
 _SETUPTOOLS_VERSION = "84.2.1"
-_PIP_VERSION = "26.2.2"
+_PIP_VERSION = "26.0.1.post3"
 _PROJECTS = [
     ("setuptools", _SETUPTOOLS_VERSION, "py3"),
     ("pip", _PIP_VERSION, "py3"),
diff --git a/Lib/ensurepip/_bundled/pip-26.2.2-py3-none-any.whl b/Lib/ensurepip/_bundled/pip-26.0.1.post3-py3-none-any.whl
similarity index 53%
rename from Lib/ensurepip/_bundled/pip-26.2.2-py3-none-any.whl
rename to Lib/ensurepip/_bundled/pip-26.0.1.post3-py3-none-any.whl
index d884a0ad81170c1..3b1802d68a6cb60 100644
Binary files a/Lib/ensurepip/_bundled/pip-26.2.2-py3-none-any.whl and b/Lib/ensurepip/_bundled/pip-26.0.1.post3-py3-none-any.whl differ
diff --git a/Misc/NEWS.d/next/Security/2026-10-27-12-00-00.gh-issue-159894.AsPip1.rst b/Misc/NEWS.d/next/Security/2026-10-27-12-00-00.gh-issue-159894.AsPip1.rst
index a5e9d3fca6a55a2..7b28a8a53487816 100644
--- a/Misc/NEWS.d/next/Security/2026-10-27-12-00-00.gh-issue-159894.AsPip1.rst
+++ b/Misc/NEWS.d/next/Security/2026-10-27-12-00-00.gh-issue-159894.AsPip1.rst
@@ -1,3 +1,9 @@
-Upgrade the bundled pip in :mod:`ensurepip` to 26.2.2, which no longer trusts
-the compromised eMudhra emSign CA (the pip 23.0.1 it replaces ships a
-vendored certifi that still trusts it).
+Upgrade the bundled pip in :mod:`ensurepip` to the ActiveState security
+release 26.0.1.post3. Its vendored certifi 2026.10.23 drops the emSign ECC
+Root CA - G3, emSign Root CA - C1 and emSign ECC Root CA - C3 roots of the
+compromised eMudhra/emSign CA (GHSA-6q48-6c7w-9gw2); emSign Root CA - G1 is the
+only emSign root left. The pip 23.0.1 it replaces ships a vendored certifi
+that still trusts all four. It also patches CVE-2026-3219, CVE-2026-6357,
+CVE-2026-8643 and CVE-2026-13346, and vendors ActiveState's urllib3
+1.26.20.post4, which fixes CVE-2025-50181, CVE-2025-66418, CVE-2025-66471,
+CVE-2026-21441, CVE-2026-44431, CVE-2026-97687 and CVE-2026-97689.