diff --git a/prepare-root.sh b/prepare-root.sh
index 8294348..0cf61b8 100755
--- a/prepare-root.sh
+++ b/prepare-root.sh
@@ -363,8 +363,6 @@ umount "$sysroot"/var/cache/dnf
 
 mkdir -p "$sysroot"/usr/share/factory/{var,cfg}
 
-chroot "$sysroot" update-ca-trust
-
 #---------------
 # tpm2-tss
 if [[ -f "$sysroot"/usr/lib/udev/rules.d/60-tpm-udev.rules ]]; then
@@ -646,6 +644,10 @@ if [[ -f "$sysroot"/etc/modprobe.d/kvm.conf ]]; then
     sed -i -e 's/#options/options/g' "$sysroot"/etc/modprobe.d/kvm.conf
 fi
 
+#---------------
+# CA
+chroot "$sysroot" update-ca-trust
+
 #---------------
 # var
 rm -fr "$sysroot"/var/lib/selinux