diff --git a/.github/workflows/build-truss-transfer.yml b/.github/workflows/build-truss-transfer.yml
index bd356f22a666..404f2404d275 100644
--- a/.github/workflows/build-truss-transfer.yml
+++ b/.github/workflows/build-truss-transfer.yml
@@ -36,11 +36,13 @@ permissions:
 
 env:
   # basetenlabs/truss is a monorepo that never tags truss-transfer releases.
-  # This is the commit whose truss-transfer/Cargo.toml reads 0.0.43 ("Bump
-  # truss-transfer to 0.0.43 and truss to 0.18.5rc0", #2482); every source
-  # file, Cargo.lock and pyproject.toml in the released sdist is
-  # byte-identical to it. Move it together with TRUSS_TRANSFER_VERSION.
-  TRUSS_TRANSFER_REF: f8b024d9457c631d1b474ebb60eccf0c1f9f1e36
+  # This is the commit whose truss-transfer/Cargo.toml reads 0.0.44 ("Raise certifi
+  # and Rust TLS deps for the emSign CA fix", #2717; 0.0.43 was f8b024d9, "Bump
+  # truss-transfer to 0.0.43 and truss to 0.18.5rc0", #2482). Move it together with
+  # TRUSS_TRANSFER_VERSION: the wheel test below asserts the built package reports
+  # exactly the version being built, so a stale pin fails instead of publishing old
+  # source under a new version.
+  TRUSS_TRANSFER_REF: 8c0fc9c13cac7eba8dc31ca3874a6981226ffadd
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
@@ -109,7 +111,7 @@ jobs:
           CIBW_ENVIRONMENT_LINUX: PATH="$PATH:$HOME/.cargo/bin"
           CIBW_TEST_SOURCES: truss-transfer/example-bptr-manifest.json
           CIBW_TEST_COMMAND: >-
-            python -c "import truss_transfer, truss_transfer.truss_transfer as m; assert m.__file__.endswith('.so'), m.__file__; print(truss_transfer.__version__)" &&
+            python -c "import truss_transfer, truss_transfer.truss_transfer as m; assert m.__file__.endswith('.so'), m.__file__; assert truss_transfer.__version__ == '${{ env.TRUSS_TRANSFER_VERSION }}', truss_transfer.__version__; print(truss_transfer.__version__)" &&
             mkdir -p /static-bptr /cache &&
             cp truss-transfer/example-bptr-manifest.json /static-bptr/static-bptr-manifest.json &&
             rm -rf tmp_no_cache tmp_fs_enabled tmp_range_enabled &&
diff --git a/docs/packages/truss-transfer.yaml b/docs/packages/truss-transfer.yaml
index 67aacddf5f60..fb6b338b5eea 100644
--- a/docs/packages/truss-transfer.yaml
+++ b/docs/packages/truss-transfer.yaml
@@ -9,3 +9,4 @@ versions:
   - filename: truss_transfer-0.0.43-cp39-abi3-manylinux_2_39_riscv64.whl
     sha256: 5f90dfe715c3a56ed839865ce0f49698a7575c44d429823502cdbce73480b44f
     requires-python: '>=3.8'
+- version: 0.0.44
diff --git a/patches/truss-transfer/0.0.44/0001-truss-transfer-bump-abi3-floor-to-py39.patch b/patches/truss-transfer/0.0.44/0001-truss-transfer-bump-abi3-floor-to-py39.patch
new file mode 100644
index 000000000000..99f59224b4c2
--- /dev/null
+++ b/patches/truss-transfer/0.0.44/0001-truss-transfer-bump-abi3-floor-to-py39.patch
@@ -0,0 +1,35 @@
+From 47704a6f43bc0fb0f187c390764a939b356212e8 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Sun, 27 Sep 2026 22:37:59 +0000
+Subject: [PATCH] truss-transfer: bump abi3 floor to py39
+
+Upstream-Status: Inappropriate [manylinux_2_39_riscv64 ships no cp38 interpreter]
+
+The riscv64 manylinux image's oldest available CPython is cp39 (no cp38),
+so a wheel built here and tagged cp38-abi3 (this crate's abi3-py38
+feature) would never actually be compiled or tested against its own
+declared floor. Bump the pyo3 abi3 feature to abi3-py39 so the riscv64
+wheel's tag matches the oldest interpreter it is built and tested on;
+every other platform's wheel is unaffected.
+
+Signed-off-by: Ludovic Henry <git@ludovic.dev>
+---
+ truss-transfer/Cargo.toml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/truss-transfer/Cargo.toml b/truss-transfer/Cargo.toml
+index d75c3b4c..873755fe 100644
+--- a/truss-transfer/Cargo.toml
++++ b/truss-transfer/Cargo.toml
+@@ -13,7 +13,7 @@ async-trait = "0.1"
+ chrono = { version = "0.4", features = ["serde"] }
+ futures-util = "0.3"
+ bytes = "1.5"
+-pyo3 = { version = "0.24.1", features = ["extension-module", "abi3-py38"] }
++pyo3 = { version = "0.24.1", features = ["extension-module", "abi3-py39"] }
+ pyo3-async-runtimes = { version = "0.24", features = ["tokio-runtime"] }
+ numpy = "0.24"
+ base64 = "0.22"
+-- 
+2.43.0
+