Yeah, at some point I gave up and asked AI to do patching for me. It was a good call because it found affected certificates in places where I wouldn't look (e.g. aws-cli or Libre Office).