diff --git a/lib/certificates b/lib/certificates
index ad28d2ee548bd..d7c6385f67166 160000
--- a/lib/certificates
+++ b/lib/certificates
@@ -1 +1 @@
-Subproject commit ad28d2ee548bd55033f0a88df6f8902589c365a6
+Subproject commit d7c6385f671665820ea2d307b0a94f9e61ef6f91
diff --git a/ports/raspberrypi/Makefile b/ports/raspberrypi/Makefile
index 6565af79bf3e1..ba2db8a750825 100644
--- a/ports/raspberrypi/Makefile
+++ b/ports/raspberrypi/Makefile
@@ -655,7 +655,7 @@ CFLAGS += \
 	  -isystem $(TOP)/lib/mbedtls/include \
 	  -DMBEDTLS_CONFIG_FILE='"$(TOP)/lib/mbedtls_config/mbedtls_config.h"' \
 
-$(BUILD)/x509_crt_bundle.S: $(TOP)/lib/certificates/data/roots.pem $(TOP)/tools/gen_crt_bundle.py
+$(BUILD)/x509_crt_bundle.S: $(TOP)/lib/certificates/data/roots-full.pem $(TOP)/tools/gen_crt_bundle.py
 	$(Q)$(PYTHON) $(TOP)/tools/gen_crt_bundle.py -i $< -o $@ --asm
 OBJ_MBEDTLS := $(BUILD)/x509_crt_bundle.o
 $(patsubst %.c,$(BUILD)/%.o,$(SRC_MBEDTLS))): CFLAGS += -Wno-suggest-attribute=format
diff --git a/ports/raspberrypi/boards/cytron_edu_pico_w/mpconfigboard.mk b/ports/raspberrypi/boards/cytron_edu_pico_w/mpconfigboard.mk
index 0bbfb4fce648a..384b0060df87e 100644
--- a/ports/raspberrypi/boards/cytron_edu_pico_w/mpconfigboard.mk
+++ b/ports/raspberrypi/boards/cytron_edu_pico_w/mpconfigboard.mk
@@ -34,6 +34,9 @@ CFLAGS += \
 # Must be accompanied by a linker script change
 CFLAGS += -DCIRCUITPY_FIRMWARE_SIZE='(1536 * 1024)'
 
+# The default is -O3. Change to -O2 because the build was overflowing.
+OPTIMIZATION_FLAGS = -O2
+
 # Include these Python libraries in firmware.
 FROZEN_MPY_DIRS += $(TOP)/frozen/Adafruit_CircuitPython_NeoPixel
 FROZEN_MPY_DIRS += $(TOP)/frozen/Adafruit_CircuitPython_Motor
diff --git a/ports/raspberrypi/boards/wiznet_w5100s_evb_pico/mpconfigboard.mk b/ports/raspberrypi/boards/wiznet_w5100s_evb_pico/mpconfigboard.mk
index 4753e28eb0d0d..3ab04a098335f 100644
--- a/ports/raspberrypi/boards/wiznet_w5100s_evb_pico/mpconfigboard.mk
+++ b/ports/raspberrypi/boards/wiznet_w5100s_evb_pico/mpconfigboard.mk
@@ -12,3 +12,6 @@ CIRCUITPY__EVE = 1
 CIRCUITPY_FLOPPYIO = 0
 CIRCUITPY_SSL = 1
 CIRCUITPY_USB_HOST = 0
+
+# The default is -O3. Change to -O2 because the build was overflowing.
+OPTIMIZATION_FLAGS = -O2
diff --git a/ports/raspberrypi/boards/wiznet_w5100s_evb_pico2/mpconfigboard.mk b/ports/raspberrypi/boards/wiznet_w5100s_evb_pico2/mpconfigboard.mk
index 972b560c84501..3e3542120e362 100644
--- a/ports/raspberrypi/boards/wiznet_w5100s_evb_pico2/mpconfigboard.mk
+++ b/ports/raspberrypi/boards/wiznet_w5100s_evb_pico2/mpconfigboard.mk
@@ -11,3 +11,6 @@ EXTERNAL_FLASH_DEVICES = "W25Q32JVxQ"
 
 CIRCUITPY__EVE = 1
 CIRCUITPY_SSL = 1
+
+# The default is -O3. Change to -O2 because the build was overflowing.
+OPTIMIZATION_FLAGS = -O2
diff --git a/ports/raspberrypi/boards/wiznet_w5500_evb_pico/mpconfigboard.mk b/ports/raspberrypi/boards/wiznet_w5500_evb_pico/mpconfigboard.mk
index 837246198a42c..4a8343963bc98 100644
--- a/ports/raspberrypi/boards/wiznet_w5500_evb_pico/mpconfigboard.mk
+++ b/ports/raspberrypi/boards/wiznet_w5500_evb_pico/mpconfigboard.mk
@@ -12,3 +12,6 @@ CIRCUITPY__EVE = 1
 CIRCUITPY_FLOPPYIO = 0
 CIRCUITPY_SSL = 1
 CIRCUITPY_USB_HOST = 0
+
+# The default is -O3. Change to -O2 because the build was overflowing.
+OPTIMIZATION_FLAGS = -O2
diff --git a/ports/raspberrypi/boards/wiznet_w5500_evb_pico2/mpconfigboard.mk b/ports/raspberrypi/boards/wiznet_w5500_evb_pico2/mpconfigboard.mk
index 52ffc6ea311c2..c10c7aa7eb892 100644
--- a/ports/raspberrypi/boards/wiznet_w5500_evb_pico2/mpconfigboard.mk
+++ b/ports/raspberrypi/boards/wiznet_w5500_evb_pico2/mpconfigboard.mk
@@ -11,3 +11,6 @@ EXTERNAL_FLASH_DEVICES = "W25Q32JVxQ"
 
 CIRCUITPY__EVE = 1
 CIRCUITPY_SSL = 1
+
+# The default is -O3. Change to -O2 because the build was overflowing.
+OPTIMIZATION_FLAGS = -O2
diff --git a/ports/zephyr-cp/cptools/build_circuitpython.py b/ports/zephyr-cp/cptools/build_circuitpython.py
index 15ed46b794e22..61e103e9fe109 100644
--- a/ports/zephyr-cp/cptools/build_circuitpython.py
+++ b/ports/zephyr-cp/cptools/build_circuitpython.py
@@ -530,7 +530,7 @@ async def build_circuitpython():
 
         if "ssl" in enabled_modules:
             crt_bundle = builddir / "x509_crt_bundle.S"
-            roots_pem = srcdir / "lib/certificates/data/roots.pem"
+            roots_pem = srcdir / "lib/certificates/data/roots-full.pem"
             generator = srcdir / "tools/gen_crt_bundle.py"
             tg.create_task(
                 cpbuild.run_command(