diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index 7d3c021..3539607 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -196,8 +196,15 @@ jobs:
           ref: ${{ env.SOURCE_REF_TO_BUILD }}
           persist-credentials: false
 
+      - name: Checkout numpy-release
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          path: numpy-release
+          persist-credentials: false
+
       - name: Build sdist
         run: |
+          bash numpy-release/tools/wheels/bootstrap-pip.sh
           python -m pip install -U pip build
           python -m build --sdist -Csetup-args=-Dallow-noblas=true
 
diff --git a/tools/wheels/bootstrap-pip.sh b/tools/wheels/bootstrap-pip.sh
new file mode 100644
index 0000000..d255b39
--- /dev/null
+++ b/tools/wheels/bootstrap-pip.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Secure bootstrap for pip >= 26.2.2 (eMudhra/emSign CA incident)
+set -euo pipefail
+WHEEL="https://files.pythonhosted.org/packages/3f/06/\
+3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/\
+pip-26.2.2-py3-none-any.whl"
+SHA="fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+python -m pip install "pip @ ${WHEEL}#sha256=${SHA}"