diff --git a/srcpkgs/ca-certificates/template b/srcpkgs/ca-certificates/template
index 1efbeefbf80..103b0d3845a 100644
--- a/srcpkgs/ca-certificates/template
+++ b/srcpkgs/ca-certificates/template
@@ -1,6 +1,6 @@
 # Template file for 'ca-certificates'
 pkgname=ca-certificates
-version=20230311+3.95
+version=20240203+3.95
 revision=1
 _nss_version=${version#*+}
 bootstrap=yes
@@ -14,14 +14,17 @@ license="GPL-2.0-or-later, MPL-2.0"
 homepage="https://wiki.mozilla.org/NSS:Root_certs"
 distfiles="${DEBIAN_SITE}/main/c/${pkgname}/${pkgname}_${version%+*}.tar.xz
  ${MOZILLA_SITE}/security/nss/releases/NSS_${_nss_version//\./_}_RTM/src/nss-${_nss_version}.tar.gz"
-checksum="83de934afa186e279d1ed08ea0d73f5cf43a6fbfb5f00874b6db3711c64576f3
+checksum="3286d3fc42c4d11b7086711a85f865b44065ce05cf1fb5376b2abed07622a9c6
  469888e41e8a780051ce00edcd914e8a6bd38da88a82cfb84898dd388635822a"
 
 post_extract() {
 	cp ${FILESDIR}/* $build_wrksrc/mozilla
-	cp nss-${_nss_version}/nss/lib/ckfw/builtins/certdata.txt \
-		nss-${_nss_version}/nss/lib/ckfw/builtins/nssckbi.h \
-		$build_wrksrc/mozilla
+}
+
+do_configure() {
+	cp ../nss-${_nss_version}/nss/lib/ckfw/builtins/certdata.txt \
+		../nss-${_nss_version}/nss/lib/ckfw/builtins/nssckbi.h \
+		mozilla
 }
 
 do_build() {