diff --git a/c2pa-native-version.txt b/c2pa-native-version.txt
index 9afb3915..65a1dfc3 100644
--- a/c2pa-native-version.txt
+++ b/c2pa-native-version.txt
@@ -1 +1 @@
-c2pa-v0.91.6
+c2pa-v0.91.7
diff --git a/docs/project-contributions.md b/docs/project-contributions.md
index adc522c9..48820ba9 100644
--- a/docs/project-contributions.md
+++ b/docs/project-contributions.md
@@ -28,12 +28,15 @@ pip install -r requirements.txt
 pip install -r requirements-dev.txt
 ```
 
-Download [c2pa-rs library artifacts](https://github.com/contentauth/c2pa-rs/tags) for the current version you want (for example, as shown below for v0.91.3):
+Download [c2pa-rs library artifacts](https://github.com/contentauth/c2pa-rs/tags) for the release selected in `c2pa-native-version.txt`:
 
 ```bash
-python scripts/download_artifacts.py c2pa-v0.91.3
+make download-native-artifacts
 ```
 
+Without `make`, pass the tag from `c2pa-native-version.txt` directly to
+`python scripts/download_artifacts.py` (currently `c2pa-v0.91.7`).
+
 Install the package in development mode:
 
 ```bash
diff --git a/docs/release-notes.md b/docs/release-notes.md
index f8f09717..1382f915 100644
--- a/docs/release-notes.md
+++ b/docs/release-notes.md
@@ -1,5 +1,25 @@
 # Release notes
 
+## Version 0.38.3
+
+### TLS trust stores
+
+Release builds select c2pa-rs `c2pa-v0.91.7` through
+`c2pa-native-version.txt`. Rebuild or upgrade installed wheels to update the
+bundled native library; updating Python dependencies alone does not update it.
+Local source builds and externally supplied libraries must also use patched
+c2pa-rs dependencies.
+
+Python artifact downloads use Requests and require `certifi>=2026.10.19`, whose
+CA bundle removes the affected emSign ECC Root CA - G3. This is separate from
+the native SDK's TLS verification. Custom bundles (including `REQUESTS_CA_BUNDLE`
+or `CURL_CA_BUNDLE` overrides), Python/OpenSSL default stores used by
+`urllib.request` in `examples/read.py`, and installer/build tools need their own
+updates. Keep the operating system, Python runtime, and packaging tools current,
+and verify custom stores against the
+[eMudhra incident's affected chains](https://emudhra.we-have-a-problem.com/);
+updating certifi does not patch these other stores.
+
 ## Version 0.33.0
 
 ### Breaking changes
diff --git a/pyproject.toml b/pyproject.toml
index 7c3cd5dd..3178d33c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "c2pa-python"
-version = "0.38.2"
+version = "0.38.3"
 requires-python = ">=3.10"
 description = "Python bindings for the C2PA Content Authenticity Initiative (CAI) library"
 readme = { file = "README.md", content-type = "text/markdown" }
@@ -24,6 +24,7 @@ urls = {homepage = "https://contentauthenticity.org", repository = "https://gith
 dependencies = [
     "toml>=0.10.2",
     "cryptography>=41.0.0",
+    "certifi>=2026.10.19",
     "requests>=2.0.0"
 ]
 
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 083439e7..45a2351d 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -9,6 +9,7 @@ pytest>=8.1.0
 
 # for downloading the library artifacts
 requests>=2.0.0
+certifi>=2026.10.19
 
 # Code formatting
 autopep8>=2.3.0