diff --git a/src/helpers/mqtt/MQTTCaCerts.h b/src/helpers/mqtt/MQTTCaCerts.h
index 336d6996..d0c8e298 100644
--- a/src/helpers/mqtt/MQTTCaCerts.h
+++ b/src/helpers/mqtt/MQTTCaCerts.h
@@ -2,7 +2,8 @@
 
 namespace mqtt_ca_certs {
 
-// EastMesh currently presents a Let's Encrypt E7-issued certificate.
+// EastMesh presented a Let's Encrypt E7-issued certificate until July 2026,
+// when it moved to a Google Trust Services WE1 wildcard (see kCombinedPem).
 static const char kEastmeshIsrgRootX1Pem[] =
 R"PEM(-----BEGIN CERTIFICATE-----
 MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
diff --git a/src/helpers/mqtt/MQTTUplink.cpp b/src/helpers/mqtt/MQTTUplink.cpp
index 5a1ef954..26868856 100644
--- a/src/helpers/mqtt/MQTTUplink.cpp
+++ b/src/helpers/mqtt/MQTTUplink.cpp
@@ -202,7 +202,9 @@ const char* MQTTUplink::brokerCaCert(const BrokerSpec& spec) {
   // Note: ESP32 targets with the certificate bundle attach it instead of these PEMs;
   // this fallback only applies on builds without CONFIG_MBEDTLS_CERTIFICATE_BUNDLE.
   if (spec.bit == kEastmeshBit || spec.bit == kMeshmapperBit) {
-    return mqtt_ca_certs::kEastmeshIsrgRootX1Pem;  // Let's Encrypt ISRG Root X1
+    // eastmesh.au switched from Let's Encrypt to a Google Trust Services WE1
+    // wildcard cert (July 2026); trust both so a switch back doesn't brick uplinks.
+    return mqtt_ca_certs::kCombinedPem;  // ISRG Root X1 + GTS WE1
   }
   // waev (mqtt.waev.app) presents a Google Trust Services WE1 chain, same issuer as LetsMesh.
   return mqtt_ca_certs::kLetsmeshWe1Pem;  // Google Trust Services WE1