diff --git a/src/httpcore2/httpcore2/_ssl.py b/src/httpcore2/httpcore2/_ssl.py
index c99c5a67..c937023f 100644
--- a/src/httpcore2/httpcore2/_ssl.py
+++ b/src/httpcore2/httpcore2/_ssl.py
@@ -1,9 +1,12 @@
+import os
 import ssl
 
-import certifi
+import truststore
 
 
 def default_ssl_context() -> ssl.SSLContext:
-    context = ssl.create_default_context()
-    context.load_verify_locations(certifi.where())
-    return context
+    if cafile := os.environ.get("SSL_CERT_FILE"):  # pragma: no cover
+        return ssl.create_default_context(cafile=cafile)
+    if capath := os.environ.get("SSL_CERT_DIR"):  # pragma: no cover
+        return ssl.create_default_context(capath=capath)
+    return truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
diff --git a/src/httpcore2/pyproject.toml b/src/httpcore2/pyproject.toml
index cc857497..cf30fc87 100644
--- a/src/httpcore2/pyproject.toml
+++ b/src/httpcore2/pyproject.toml
@@ -41,7 +41,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
     "Topic :: Internet :: WWW/HTTP",
 ]
-dependencies = ["certifi", "h11>=0.16"]
+dependencies = ["truststore>=0.10", "h11>=0.16"]
 
 [project.optional-dependencies]
 http2 = ["h2>=3,<5"]
diff --git a/uv.lock b/uv.lock
index 3bbb1181..9e017891 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1317,8 +1317,8 @@ wheels = [
 name = "httpcore2"
 source = { editable = "src/httpcore2" }
 dependencies = [
-    { name = "certifi" },
     { name = "h11" },
+    { name = "truststore" },
 ]
 
 [package.optional-dependencies]
@@ -1338,11 +1338,11 @@ trio = [
 [package.metadata]
 requires-dist = [
     { name = "anyio", marker = "extra == 'asyncio'", specifier = ">=4.5.0,<5.0" },
-    { name = "certifi" },
     { name = "h11", specifier = ">=0.16" },
     { name = "h2", marker = "extra == 'http2'", specifier = ">=3,<5" },
     { name = "socksio", marker = "extra == 'socks'", specifier = "==1.*" },
     { name = "trio", marker = "extra == 'trio'", specifier = ">=0.22.0,<1.0" },
+    { name = "truststore", specifier = ">=0.10" },
 ]
 provides-extras = ["asyncio", "http2", "socks", "trio"]