Mail.protection.outlook.com STARTTLS cert verify failed since ~June 15th, anyone else affected?

Since around June 15th, several of my Laravel applications using Microsoft 365/Exchange connector (mail.protection.outlook.com on port 25, STARTTLS) started throwing:

Unable to connect with STARTTLS: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages: error:0A000086:SSL routines::certificate verify failed

Relevant config (nothing on my end has changed):

Protocol: SMTP
Host: xxx.mail.protection.outlook.com
Port: 25
Encryption: TLS

From what I've found digging around, this seems related to the DigiCert Global Root CA (G1) deprecation. Mozilla/Chrome dropped trust for that root back in April, and it looks like Microsoft's MX certs for mail.protection.outlook.com are still chaining up to that old G1 root instead of the newer G2 root. So any Linux box that's had its ca-certificates package updated recently will start rejecting the cert chain on outbound SMTP connections, which lines up with the timing for me.

I confirmed it's not application-specific (happens across multiple unrelated Laravel apps, all on different servers), and openssl s_client -starttls smtp -connect xxx.mail.protection.outlook.com:25 -verify_return_error reproduces the same "unable to get local issuer certificate" error outside of PHP entirely.

• Is anyone else seeing this since mid/late June?
• Did you find a permanent fix, or are you running with verify_peer disabled as a stopgap?
• Has anyone gotten confirmation from Microsoft that they're aware / fixing the cert chain?
• Anyone manually re-added the old G1 root to their trust store as a workaround, and is that actually safe to do?

Would rather not run production mail with TLS verification disabled long-term, so curious how others are handling this in the meantime.