diff --git a/recipe/gen_patch_json.py b/recipe/gen_patch_json.py
index 84a6a1e29..1a76053af 100644
--- a/recipe/gen_patch_json.py
+++ b/recipe/gen_patch_json.py
@@ -3044,6 +3044,9 @@ def _gen_new_index_per_key(repodata, subdir, index_key):
             _replace_pin("werkzeug >=1.0,<3.0", "werkzeug >=1.0,<2.3", record["depends"], record)
             record["depends"].remove("importlib-metadata >=1")
 
+        if record_name == "conda-content-trust" and record.get("timestamp", 0) < 1685589411000:  # 2023-06-01
+            _replace_pin("cryptography", "cryptography <41.0.0a0", record["depends"], record)
+
         # noarch depfinder packages are broken for python >=3.10
         if (
             record_name == "depfinder"