diff --git a/configuration.nix b/configuration.nix
index bbac5bf..27af295 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -129,6 +129,13 @@
     }];
   };
 
+  security.pki.caCertificateBlacklist = [
+    "Comodo AAA Services root"
+    "emSign ECC Root CA - G3"
+    "emSign Root CA - C1"
+    "emSign ECC Root CA - C3"
+  ];
+
   services.pulseaudio.enable = false;
   services.pipewire = {
     enable = true;