Progress!
I’ve figured out how to download and install the latest updater-ng and ca-certificates from the latest 3.x. This post helped me to understand how to install packages in the factory state using the opkg-trans command: Návod: Jak na Turrisu 1.x správně provést aktualizaci NOR a přechod na btrfs
So basically I downloaded the ca-certificates from here: Index of /turris/packages/base/ and the updater-ng from here: Index of /turris/packages/turrispackages/. I had to use curl -k, obviously, since the wget form the factory install doesn’t talk to that domain at all.
I used the steps in the above mentioned post to install the new updater and the certs and then ran pkgupdate --batch which managed to download the updates.
So now I’m back on 3.11.23!
I already got a microSD card so I’ll try to upgrade to a newer version of Turris OS.