diff --git a/secure/caroot/Makefile b/secure/caroot/Makefile
--- a/secure/caroot/Makefile
+++ b/secure/caroot/Makefile
@@ -7,7 +7,7 @@
 
 # To be used by secteam@ to update the trusted certificates
 fetchcerts: .PHONY
-	fetch --no-sslv3 --no-tlsv1 -o certdata.txt 'https://hg.mozilla.org/projects/nss/raw-file/tip/lib/ckfw/builtins/certdata.txt'
+	fetch --no-sslv3 --no-tlsv1 -o certdata.txt 'https://raw.githubusercontent.com/mozilla-firefox/firefox/refs/heads/release/security/nss/lib/ckfw/builtins/certdata.txt'
 
 cleancerts: .PHONY
 	@${MAKE} -C ${.CURDIR}/trusted ${.TARGET}