diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index de10dbd4a6..2ffc6b9545 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -40,7 +40,7 @@ jobs:
       - run: npm run build
       - run: npm test
       - name: Install xmllint
-        run: sudo apt-get install -y libxml2-utils
+        run: sudo apt-get update && sudo apt-get install -y libxml2-utils
       - name: Validate RSS feed
         run: xmllint --noout public/feed.xml
       # - run: npm run test:html5validate
diff --git a/config/_default/server.toml b/config/_default/server.toml
index 1f7a6d0af0..d4777c92f4 100644
--- a/config/_default/server.toml
+++ b/config/_default/server.toml
@@ -18,7 +18,7 @@ Permissions-Policy = """
     fullscreen=(self),
     interest-cohort=()
 """
-# "connect-src https://d4twhgtvn0ff5.cloudfront.net/ and https://d1dfn7jg27m4cf.cloudfront.net/" for stats graphs
+# "connect-src https://d1dfn7jg27m4cf.cloudfront.net/" for stats graphs
 # "img-src data: blob:" is for Plotly download feature
 # "script-src unsafe-eval unsafe-inline data:": For Google Analytics
 # "form-action" is NOT set, so it allows everything (it doesn't default to default-src). If restricted, It must allow at least www.paypal.com and its redirects
@@ -78,7 +78,6 @@ Content-Security-Policy = """
         https://widget.thegivingblock.com/
     ;
     connect-src 'self'
-        https://d4twhgtvn0ff5.cloudfront.net/
         https://d1dfn7jg27m4cf.cloudfront.net/
         https://donorbox.org
         https://doublethedonation.com
diff --git a/content/en/stats.html b/content/en/stats.html
index eb738fbdf1..d70cac7f5c 100644
--- a/content/en/stats.html
+++ b/content/en/stats.html
@@ -3,7 +3,7 @@
 linkTitle: Statistics
 slug: stats
 excerpt: Let's Encrypt certificate statistics.
-lastmod: 2026-08-18
+lastmod: 2026-09-24
 menu:
   main:
     weight: 70
diff --git a/netlify.toml b/netlify.toml
index 807b4047c0..9dc4971e9c 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -28,7 +28,7 @@ Permissions-Policy = """
     fullscreen=(self),
     interest-cohort=()
 """
-# "connect-src https://d4twhgtvn0ff5.cloudfront.net/ and https://d1dfn7jg27m4cf.cloudfront.net/" for stats graphs
+# "connect-src https://d1dfn7jg27m4cf.cloudfront.net/" for stats graphs
 # "img-src data: blob:" is for Plotly download feature
 # "script-src unsafe-eval unsafe-inline data:": For Google Analytics
 # "form-action" is NOT set, so it allows everything (it doesn't default to default-src). If restricted, It must allow at least www.paypal.com and its redirects
@@ -88,7 +88,6 @@ Content-Security-Policy = """
         https://widget.thegivingblock.com/
     ;
     connect-src 'self'
-        https://d4twhgtvn0ff5.cloudfront.net/
         https://d1dfn7jg27m4cf.cloudfront.net/
         https://donorbox.org
         https://doublethedonation.com
diff --git a/static/js/stats.js b/static/js/stats.js
index e8d4993bd4..abe1a59a5c 100644
--- a/static/js/stats.js
+++ b/static/js/stats.js
@@ -322,17 +322,10 @@ function doPlot() {
   if ( location.hostname === "localhost" ) {
     path = "/js/"; // in dev, will use old data.
   } else {
-    path = "https://d4twhgtvn0ff5.cloudfront.net/";
+    path = "https://d1dfn7jg27m4cf.cloudfront.net/";
   }
 
-  var statsPath;
-  if ( location.hostname === "localhost" ) {
-    statsPath = "/js/"; // in dev, will use old data.
-  } else {
-    statsPath = "https://d1dfn7jg27m4cf.cloudfront.net/";
-  }
-
-  fetch(statsPath+"cert-daily-stats.tsv")
+  fetch(path+"cert-daily-stats.tsv")
   .then(response => {
     return response.text();
   }).then(tsvListener);