diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index c6eaa72d2df1..73492baa076a 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2023.11.17";
+  version = "2024.02.02";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-certifi";
     rev = version;
-    hash = "sha256-H3zsFJjWt2+tT7yqQOOZZwSL5y0AtfDz6Fqxwpm4Wl8=";
+    hash = "sha256-gnWJjZy5E/0lvAeLftXNtcHH6RHL/dUomXOBgumiWX8=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/certifi/env.patch b/pkgs/development/python-modules/certifi/env.patch
index 292f977ef2c0..97a48b46e05f 100644
--- a/pkgs/development/python-modules/certifi/env.patch
+++ b/pkgs/development/python-modules/certifi/env.patch
@@ -1,13 +1,17 @@
 diff --git a/certifi/core.py b/certifi/core.py
-index de02898..c033d20 100644
+index 91f538b..1110ce0 100644
 --- a/certifi/core.py
 +++ b/certifi/core.py
-@@ -4,15 +4,25 @@ certifi.py
+@@ -4,6 +4,7 @@ certifi.py
  
  This module returns the installation location of cacert.pem or its contents.
  """
 +import os
  import sys
+ import atexit
+ 
+@@ -11,12 +12,21 @@ def exit_cacert_ctx() -> None:
+     _CACERT_CTX.__exit__(None, None, None)  # type: ignore[union-attr]
  
  
 +def get_cacert_path_from_environ():
@@ -29,17 +33,16 @@ index de02898..c033d20 100644
  
      def where() -> str:
          # This is slightly terrible, but we want to delay extracting the file
-@@ -39,14 +49,16 @@ if sys.version_info >= (3, 11):
+@@ -44,6 +54,8 @@ if sys.version_info >= (3, 11):
          return _CACERT_PATH
  
      def contents() -> str:
--        return files("certifi").joinpath("cacert.pem").read_text(encoding="ascii")
 +        if _CACERT_PATH is not None:
 +            return open(_CACERT_PATH, encoding="utf-8").read()
-+        return files("certifi").joinpath("cacert.pem").read_text(encoding="utf-8")
+         return files("certifi").joinpath("cacert.pem").read_text(encoding="ascii")
  
  elif sys.version_info >= (3, 7):
- 
+@@ -51,7 +63,7 @@ elif sys.version_info >= (3, 7):
      from importlib.resources import path as get_path, read_text
  
      _CACERT_CTX = None
@@ -48,7 +51,7 @@ index de02898..c033d20 100644
  
      def where() -> str:
          # This is slightly terrible, but we want to delay extracting the
-@@ -74,7 +86,9 @@ elif sys.version_info >= (3, 7):
+@@ -80,7 +92,9 @@ elif sys.version_info >= (3, 7):
          return _CACERT_PATH
  
      def contents() -> str:
@@ -59,7 +62,7 @@ index de02898..c033d20 100644
  
  else:
      import os
-@@ -84,6 +98,8 @@ else:
+@@ -90,6 +104,8 @@ else:
      Package = Union[types.ModuleType, str]
      Resource = Union[str, "os.PathLike"]
  
@@ -68,7 +71,7 @@ index de02898..c033d20 100644
      # This fallback will work for Python versions prior to 3.7 that lack the
      # importlib.resources module but relies on the existing `where` function
      # so won't address issues with environments like PyOxidizer that don't set
-@@ -102,7 +118,14 @@ else:
+@@ -108,7 +124,13 @@ else:
      def where() -> str:
          f = os.path.dirname(__file__)
  
@@ -78,9 +81,7 @@ index de02898..c033d20 100644
          return os.path.join(f, "cacert.pem")
  
      def contents() -> str:
--        return read_text("certifi", "cacert.pem", encoding="ascii")
 +        if _CACERT_PATH is not None:
 +            with open(_CACERT_PATH, encoding="utf-8") as data:
 +                return data.read()
-+
-+        return read_text("certifi", "cacert.pem", encoding="utf-8")
+         return read_text("certifi", "cacert.pem", encoding="ascii")