diff --git a/ci/headless/justifications.yaml b/ci/headless/justifications.yaml
index 61ef4ea..e99da5b 100644
--- a/ci/headless/justifications.yaml
+++ b/ci/headless/justifications.yaml
@@ -84,9 +84,10 @@ justifications:
 
   # openssl-libs: added by this image (the crypto NIF links libcrypto). Red Hat lists no fix for
   # either; `dnf upgrade` ran against the installroot at build time, so this is the newest build
-  # UBI's repositories carried.
+  # UBI's repositories carried. Re-pinned 2026-10-08 from 3.5.8-1 to Red Hat's 3.5.8-2 rebuild, which
+  # the scan still reports as not fixed for both.
   - finding: "CVE-2026-75804"
-    package: "openssl-libs-1:3.5.8-1.el9_8"
+    package: "openssl-libs-1:3.5.8-2.el9_8"
     packagePath: null
     severity: "high"
     scanSource: "grype"
@@ -97,7 +98,7 @@ justifications:
       application implements TLS in Erlang without libssl. Red Hat lists no fix; the build ran dnf
       upgrade, so this is the newest openssl-libs UBI carried.
   - finding: "CVE-2026-84782"
-    package: "openssl-libs-1:3.5.8-1.el9_8"
+    package: "openssl-libs-1:3.5.8-2.el9_8"
     packagePath: null
     severity: "high"
     scanSource: "grype"