diff --git a/.test/tests/java-ca-certificates-update/certs/README.md b/.test/tests/java-ca-certificates-update/certs/README.md
index a88f367b4..8874ae8bc 100644
--- a/.test/tests/java-ca-certificates-update/certs/README.md
+++ b/.test/tests/java-ca-certificates-update/certs/README.md
@@ -4,7 +4,6 @@ These certificate/key pairs has been generated with
 $ openssl req -nodes -new -x509 -days 358000 -subj "/DC=Temurin/CN=DockerBuilder" -keyout certs/.dockerbuilder.key -out certs/.dockerbuilder.crt
 $ openssl req -nodes -new -x509 -days 358000 -subj "/DC=Temurin/CN=DockerBuilder2" -keyout certs/.dockerbuilder2.key -out certs/.dockerbuilder2.crt
 $ cat certs/.dockerbuilder.crt certs/.dockerbuilder2.crt > certs/multi-cert.crt
-$ openssl req -nodes -new -x509 -days 358000 -subj "/DC=Temurin/CN=DockerBuilder3" -keyout certs/subfolder/.dockerbuilder3.key -out certs/subfolder/.dockerbuilder3.crt
 ```
 
  and are only used for testing
diff --git a/.test/tests/java-ca-certificates-update/certs/subfolder/.dockerbuilder3.crt b/.test/tests/java-ca-certificates-update/certs/subfolder/.dockerbuilder3.crt
deleted file mode 100644
index 4a04e60a2..000000000
--- a/.test/tests/java-ca-certificates-update/certs/subfolder/.dockerbuilder3.crt
+++ /dev/null
@@ -1,20 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDRzCCAi+gAwIBAgIUVeQPX1YvKMxeCBQBIOHo/toG/EAwDQYJKoZIhvcNAQEL
-BQAwMjEXMBUGCgmSJomT8ixkARkWB1RlbXVyaW4xFzAVBgNVBAMMDkRvY2tlckJ1
-aWxkZXIzMCAXDTI2MDUxMjA3MTU1NloYDzMwMDYwNzE0MDcxNTU2WjAyMRcwFQYK
-CZImiZPyLGQBGRYHVGVtdXJpbjEXMBUGA1UEAwwORG9ja2VyQnVpbGRlcjMwggEi
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCW3I7swRT7GQwhD9w4MJn8K42P
-RtkhuBpeq5pDHXAnhg/Fah61BgoLEx3lS9yuBgWE1icspm5qJIn+8X/8+7NolB+f
-KDlKWGhnR8YPqe62I79EpoeJKqSlYpBM1ptcRfeEuyfoaYCrPuzq4yanRrRdPnN2
-22SP2hkLnQlbn6C0nCGugwXDCdyJ2VG/Ks1lpSvM9IWKoKuzWDiOR7vqbxMPrYWn
-KIiDMtuBNI1VgbY2GCic5YRkerAP13ydrUZdgHllovgnvrip41E4/SAVCtrBdZ61
-ZYlvxbdKqYxwRtxocAeb6EL+abubemIPIoIwinbKCojaysYqGLkCFwxr2/zJAgMB
-AAGjUzBRMB0GA1UdDgQWBBSWvbfXY7eorZihHEF05N7qqqizXTAfBgNVHSMEGDAW
-gBSWvbfXY7eorZihHEF05N7qqqizXTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
-DQEBCwUAA4IBAQB/rBMBivpsy8ziN7LQ1rfbSOm7JiyPLq9/uOpP4fPldJ6LUDVF
-IP6/ruRAr/JRRW6qfsadzNCpJtSXE97sCIfoZ5yp8E8/oXUZRNtlaMb+MF7Qf78/
-1DCCKi/QCn6K6sZUz14A58jse0vwcpHc6OUtC2HZIWvVIGLnn6mytfTNvY60hvyv
-V2o3Y+rFyHt+gi77LFqBB3HiJiP5HWe1GoN8k3DwJUvPJ5Ij/y1sYFtvX/19+azB
-9GdoxnZPgWcdyKV/34hnWHH0ZBcP+i7S3ZSbJFnWUH2xF2NQjTnhsb3CY7vUSbTz
-TXmV0zZSB/8MQsMOFJpJF+TH2udTjtvIDn4N
------END CERTIFICATE-----
diff --git a/.test/tests/java-ca-certificates-update/certs/subfolder/.dockerbuilder3.key b/.test/tests/java-ca-certificates-update/certs/subfolder/.dockerbuilder3.key
deleted file mode 100644
index 55ea38ad8..000000000
--- a/.test/tests/java-ca-certificates-update/certs/subfolder/.dockerbuilder3.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCW3I7swRT7GQwh
-D9w4MJn8K42PRtkhuBpeq5pDHXAnhg/Fah61BgoLEx3lS9yuBgWE1icspm5qJIn+
-8X/8+7NolB+fKDlKWGhnR8YPqe62I79EpoeJKqSlYpBM1ptcRfeEuyfoaYCrPuzq
-4yanRrRdPnN222SP2hkLnQlbn6C0nCGugwXDCdyJ2VG/Ks1lpSvM9IWKoKuzWDiO
-R7vqbxMPrYWnKIiDMtuBNI1VgbY2GCic5YRkerAP13ydrUZdgHllovgnvrip41E4
-/SAVCtrBdZ61ZYlvxbdKqYxwRtxocAeb6EL+abubemIPIoIwinbKCojaysYqGLkC
-Fwxr2/zJAgMBAAECggEACIIHzXJWLJMNDBBI6yJSjNYn9ZyZQj2PvycOXBqc6J22
-5ftGIA9nIZjCZtwQZgAQ75zkOLBqKbJF1gronOvVAmDYJ7GtCXRS7wAtO1TqEXuS
-ndyGaEXvYyRb3vl7aYjInMOxTHomt4Gk+to0o9po8ZlECb/1u+cg4nbIwFIQTh8p
-2gZdarFlN//CFoLLNNAy1tVs/6xtByazmdhgTeUgIaFsPIJzUWm17PpKFNKumOHq
-B9pOwDj874/Px/KHz3AbOkQiyy92XDC4SVhSFFXGN8TPhZAzxar5BPwyJhNnWy5x
-Vbid/7JkLFI5AeO5d1V4WNgXOOSZnItG5MEIbjd9wQKBgQDKflHEJIoxgRNXcCZk
-jK7XCjjiPh+yYVLNTpA5Fczf96X2lZ8mdcnQ4EBw9ZW6bsvdZJ/gBjOVvHsSIuJm
-rINpObqksWPjglk5094/A5pXy5HasySgak/CbVPSzp/IeDhVGoF0H6WVxxI4IORV
-KIIjUe9o7iMp2vhKNtQql7M0ywKBgQC+uZjp/v8ev0koa34yBIBURgoOcYfaCtYg
-9b6QzZuv2vgxAzh+mUCjGbw17OP9Mab3bSqWVxelXqslO3aqXDcPc/x6TBYEAELa
-2ozpDq3XWxUhfUkhIlyO6SoCnfGBwCmIGsFsxUAAPT7KVqR0TNDv2H3AjIdMcAjs
-BXK7F8Q2OwKBgQCKTPZZqb89CnSEXtPKDxAHTTMGyvlpIvGjycnVQ193hLQ0k4Js
-iTx6zf8VZ5aJC81ve596KaIn3eCMxYiuKZtjTgt9Gq8nn0qDpYIAtdw/pIkMvxf/
-/DxXhcYfkAIvsHSBI6ZRAqBciOeXsFdjFlSz/O0wVJ1to+G7BnGoWY4LOwKBgCN4
-52zV5WM1loiy/WSWG7wQzrwC945hJ5Q3wHq0EvmxEyoifDZnkHMFTVEGPx0PSAuK
-vTn69sXmBpTFK3vh7Met/c5NKmcSGV0U+tI5zbFZGmQBJkHIX0ihKxQThiBouhC7
-UTBGu3GP8oa1eJ68zrtdG35dZKidybsEBGOxtueTAoGANEToOvnmLFzaoZIoI9R3
-E/YBG3mf21m66RZEF7UmXOvMv/7thoxaoPxrq1+WMCybdOvXzTAT/Z9GCpjqoJ5x
-FRt80KBDAH/y+GvaLLxukdcw+FI4QD5+NLj0goOUDA/pkFpLWZtGO5JuUAvbJ689
-qDb3xmi/U1jhe5YkngdTWOM=
------END PRIVATE KEY-----
diff --git a/.test/tests/java-ca-certificates-update/certs_symlink/README.md b/.test/tests/java-ca-certificates-update/certs_symlink/README.md
index a88f367b4..8874ae8bc 100644
--- a/.test/tests/java-ca-certificates-update/certs_symlink/README.md
+++ b/.test/tests/java-ca-certificates-update/certs_symlink/README.md
@@ -4,7 +4,6 @@ These certificate/key pairs has been generated with
 $ openssl req -nodes -new -x509 -days 358000 -subj "/DC=Temurin/CN=DockerBuilder" -keyout certs/.dockerbuilder.key -out certs/.dockerbuilder.crt
 $ openssl req -nodes -new -x509 -days 358000 -subj "/DC=Temurin/CN=DockerBuilder2" -keyout certs/.dockerbuilder2.key -out certs/.dockerbuilder2.crt
 $ cat certs/.dockerbuilder.crt certs/.dockerbuilder2.crt > certs/multi-cert.crt
-$ openssl req -nodes -new -x509 -days 358000 -subj "/DC=Temurin/CN=DockerBuilder3" -keyout certs/subfolder/.dockerbuilder3.key -out certs/subfolder/.dockerbuilder3.crt
 ```
 
  and are only used for testing
diff --git a/.test/tests/java-ca-certificates-update/certs_symlink/subfolder/.dockerbuilder3.crt b/.test/tests/java-ca-certificates-update/certs_symlink/subfolder/.dockerbuilder3.crt
deleted file mode 100644
index 4a04e60a2..000000000
--- a/.test/tests/java-ca-certificates-update/certs_symlink/subfolder/.dockerbuilder3.crt
+++ /dev/null
@@ -1,20 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDRzCCAi+gAwIBAgIUVeQPX1YvKMxeCBQBIOHo/toG/EAwDQYJKoZIhvcNAQEL
-BQAwMjEXMBUGCgmSJomT8ixkARkWB1RlbXVyaW4xFzAVBgNVBAMMDkRvY2tlckJ1
-aWxkZXIzMCAXDTI2MDUxMjA3MTU1NloYDzMwMDYwNzE0MDcxNTU2WjAyMRcwFQYK
-CZImiZPyLGQBGRYHVGVtdXJpbjEXMBUGA1UEAwwORG9ja2VyQnVpbGRlcjMwggEi
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCW3I7swRT7GQwhD9w4MJn8K42P
-RtkhuBpeq5pDHXAnhg/Fah61BgoLEx3lS9yuBgWE1icspm5qJIn+8X/8+7NolB+f
-KDlKWGhnR8YPqe62I79EpoeJKqSlYpBM1ptcRfeEuyfoaYCrPuzq4yanRrRdPnN2
-22SP2hkLnQlbn6C0nCGugwXDCdyJ2VG/Ks1lpSvM9IWKoKuzWDiOR7vqbxMPrYWn
-KIiDMtuBNI1VgbY2GCic5YRkerAP13ydrUZdgHllovgnvrip41E4/SAVCtrBdZ61
-ZYlvxbdKqYxwRtxocAeb6EL+abubemIPIoIwinbKCojaysYqGLkCFwxr2/zJAgMB
-AAGjUzBRMB0GA1UdDgQWBBSWvbfXY7eorZihHEF05N7qqqizXTAfBgNVHSMEGDAW
-gBSWvbfXY7eorZihHEF05N7qqqizXTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
-DQEBCwUAA4IBAQB/rBMBivpsy8ziN7LQ1rfbSOm7JiyPLq9/uOpP4fPldJ6LUDVF
-IP6/ruRAr/JRRW6qfsadzNCpJtSXE97sCIfoZ5yp8E8/oXUZRNtlaMb+MF7Qf78/
-1DCCKi/QCn6K6sZUz14A58jse0vwcpHc6OUtC2HZIWvVIGLnn6mytfTNvY60hvyv
-V2o3Y+rFyHt+gi77LFqBB3HiJiP5HWe1GoN8k3DwJUvPJ5Ij/y1sYFtvX/19+azB
-9GdoxnZPgWcdyKV/34hnWHH0ZBcP+i7S3ZSbJFnWUH2xF2NQjTnhsb3CY7vUSbTz
-TXmV0zZSB/8MQsMOFJpJF+TH2udTjtvIDn4N
------END CERTIFICATE-----
diff --git a/.test/tests/java-ca-certificates-update/certs_symlink/subfolder/.dockerbuilder3.key b/.test/tests/java-ca-certificates-update/certs_symlink/subfolder/.dockerbuilder3.key
deleted file mode 100644
index 55ea38ad8..000000000
--- a/.test/tests/java-ca-certificates-update/certs_symlink/subfolder/.dockerbuilder3.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCW3I7swRT7GQwh
-D9w4MJn8K42PRtkhuBpeq5pDHXAnhg/Fah61BgoLEx3lS9yuBgWE1icspm5qJIn+
-8X/8+7NolB+fKDlKWGhnR8YPqe62I79EpoeJKqSlYpBM1ptcRfeEuyfoaYCrPuzq
-4yanRrRdPnN222SP2hkLnQlbn6C0nCGugwXDCdyJ2VG/Ks1lpSvM9IWKoKuzWDiO
-R7vqbxMPrYWnKIiDMtuBNI1VgbY2GCic5YRkerAP13ydrUZdgHllovgnvrip41E4
-/SAVCtrBdZ61ZYlvxbdKqYxwRtxocAeb6EL+abubemIPIoIwinbKCojaysYqGLkC
-Fwxr2/zJAgMBAAECggEACIIHzXJWLJMNDBBI6yJSjNYn9ZyZQj2PvycOXBqc6J22
-5ftGIA9nIZjCZtwQZgAQ75zkOLBqKbJF1gronOvVAmDYJ7GtCXRS7wAtO1TqEXuS
-ndyGaEXvYyRb3vl7aYjInMOxTHomt4Gk+to0o9po8ZlECb/1u+cg4nbIwFIQTh8p
-2gZdarFlN//CFoLLNNAy1tVs/6xtByazmdhgTeUgIaFsPIJzUWm17PpKFNKumOHq
-B9pOwDj874/Px/KHz3AbOkQiyy92XDC4SVhSFFXGN8TPhZAzxar5BPwyJhNnWy5x
-Vbid/7JkLFI5AeO5d1V4WNgXOOSZnItG5MEIbjd9wQKBgQDKflHEJIoxgRNXcCZk
-jK7XCjjiPh+yYVLNTpA5Fczf96X2lZ8mdcnQ4EBw9ZW6bsvdZJ/gBjOVvHsSIuJm
-rINpObqksWPjglk5094/A5pXy5HasySgak/CbVPSzp/IeDhVGoF0H6WVxxI4IORV
-KIIjUe9o7iMp2vhKNtQql7M0ywKBgQC+uZjp/v8ev0koa34yBIBURgoOcYfaCtYg
-9b6QzZuv2vgxAzh+mUCjGbw17OP9Mab3bSqWVxelXqslO3aqXDcPc/x6TBYEAELa
-2ozpDq3XWxUhfUkhIlyO6SoCnfGBwCmIGsFsxUAAPT7KVqR0TNDv2H3AjIdMcAjs
-BXK7F8Q2OwKBgQCKTPZZqb89CnSEXtPKDxAHTTMGyvlpIvGjycnVQ193hLQ0k4Js
-iTx6zf8VZ5aJC81ve596KaIn3eCMxYiuKZtjTgt9Gq8nn0qDpYIAtdw/pIkMvxf/
-/DxXhcYfkAIvsHSBI6ZRAqBciOeXsFdjFlSz/O0wVJ1to+G7BnGoWY4LOwKBgCN4
-52zV5WM1loiy/WSWG7wQzrwC945hJ5Q3wHq0EvmxEyoifDZnkHMFTVEGPx0PSAuK
-vTn69sXmBpTFK3vh7Met/c5NKmcSGV0U+tI5zbFZGmQBJkHIX0ihKxQThiBouhC7
-UTBGu3GP8oa1eJ68zrtdG35dZKidybsEBGOxtueTAoGANEToOvnmLFzaoZIoI9R3
-E/YBG3mf21m66RZEF7UmXOvMv/7thoxaoPxrq1+WMCybdOvXzTAT/Z9GCpjqoJ5x
-FRt80KBDAH/y+GvaLLxukdcw+FI4QD5+NLj0goOUDA/pkFpLWZtGO5JuUAvbJ689
-qDb3xmi/U1jhe5YkngdTWOM=
------END PRIVATE KEY-----
diff --git a/.test/tests/java-ca-certificates-update/run.sh b/.test/tests/java-ca-certificates-update/run.sh
index f5c0e5550..21f131c27 100755
--- a/.test/tests/java-ca-certificates-update/run.sh
+++ b/.test/tests/java-ca-certificates-update/run.sh
@@ -10,7 +10,7 @@ CMD1=date
 
 # CMD2 in each run is to check for the `dockerbuilder` certificate in the Java keystore. Entrypoint exports $JRE_CACERTS_PATH to
 # point to the Java keystore.
-CMD2=(sh -c "keytool -list -keystore \"\$JRE_CACERTS_PATH\" -storepass changeit -alias dockerbuilder && keytool -list -keystore \"\$JRE_CACERTS_PATH\" -storepass changeit -alias dockerbuilder2 && keytool -list -keystore \"\$JRE_CACERTS_PATH\" -storepass changeit -alias dockerbuilder3")
+CMD2=(sh -c "keytool -list -keystore \"\$JRE_CACERTS_PATH\" -storepass changeit -alias dockerbuilder && keytool -list -keystore \"\$JRE_CACERTS_PATH\" -storepass changeit -alias dockerbuilder2")
 
 # CMD3 is looking for certificates with same CN, script appends the SHA-256 fingerprint to avoid alias conflict.
 # certs_duplicate_cn/cert1.crt will be imported first with alias dockerbuilder
diff --git a/11/jdk/alpine/3.21/entrypoint.sh b/11/jdk/alpine/3.21/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/11/jdk/alpine/3.21/entrypoint.sh
+++ b/11/jdk/alpine/3.21/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jdk/alpine/3.22/entrypoint.sh b/11/jdk/alpine/3.22/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/11/jdk/alpine/3.22/entrypoint.sh
+++ b/11/jdk/alpine/3.22/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jdk/alpine/3.23/entrypoint.sh b/11/jdk/alpine/3.23/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/11/jdk/alpine/3.23/entrypoint.sh
+++ b/11/jdk/alpine/3.23/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jdk/alpine/3.24/entrypoint.sh b/11/jdk/alpine/3.24/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/11/jdk/alpine/3.24/entrypoint.sh
+++ b/11/jdk/alpine/3.24/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jdk/ubi/ubi10-minimal/entrypoint.sh b/11/jdk/ubi/ubi10-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/11/jdk/ubi/ubi10-minimal/entrypoint.sh
+++ b/11/jdk/ubi/ubi10-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/11/jdk/ubi/ubi9-minimal/entrypoint.sh b/11/jdk/ubi/ubi9-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/11/jdk/ubi/ubi9-minimal/entrypoint.sh
+++ b/11/jdk/ubi/ubi9-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/11/jdk/ubuntu/jammy/entrypoint.sh b/11/jdk/ubuntu/jammy/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/11/jdk/ubuntu/jammy/entrypoint.sh
+++ b/11/jdk/ubuntu/jammy/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jdk/ubuntu/noble/entrypoint.sh b/11/jdk/ubuntu/noble/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/11/jdk/ubuntu/noble/entrypoint.sh
+++ b/11/jdk/ubuntu/noble/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jdk/ubuntu/resolute/entrypoint.sh b/11/jdk/ubuntu/resolute/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/11/jdk/ubuntu/resolute/entrypoint.sh
+++ b/11/jdk/ubuntu/resolute/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jre/alpine/3.21/entrypoint.sh b/11/jre/alpine/3.21/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/11/jre/alpine/3.21/entrypoint.sh
+++ b/11/jre/alpine/3.21/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jre/alpine/3.22/entrypoint.sh b/11/jre/alpine/3.22/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/11/jre/alpine/3.22/entrypoint.sh
+++ b/11/jre/alpine/3.22/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jre/alpine/3.23/entrypoint.sh b/11/jre/alpine/3.23/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/11/jre/alpine/3.23/entrypoint.sh
+++ b/11/jre/alpine/3.23/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jre/alpine/3.24/entrypoint.sh b/11/jre/alpine/3.24/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/11/jre/alpine/3.24/entrypoint.sh
+++ b/11/jre/alpine/3.24/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jre/ubi/ubi10-minimal/entrypoint.sh b/11/jre/ubi/ubi10-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/11/jre/ubi/ubi10-minimal/entrypoint.sh
+++ b/11/jre/ubi/ubi10-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/11/jre/ubi/ubi9-minimal/entrypoint.sh b/11/jre/ubi/ubi9-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/11/jre/ubi/ubi9-minimal/entrypoint.sh
+++ b/11/jre/ubi/ubi9-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/11/jre/ubuntu/jammy/entrypoint.sh b/11/jre/ubuntu/jammy/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/11/jre/ubuntu/jammy/entrypoint.sh
+++ b/11/jre/ubuntu/jammy/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jre/ubuntu/noble/entrypoint.sh b/11/jre/ubuntu/noble/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/11/jre/ubuntu/noble/entrypoint.sh
+++ b/11/jre/ubuntu/noble/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/11/jre/ubuntu/resolute/entrypoint.sh b/11/jre/ubuntu/resolute/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/11/jre/ubuntu/resolute/entrypoint.sh
+++ b/11/jre/ubuntu/resolute/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jdk/alpine/3.21/entrypoint.sh b/17/jdk/alpine/3.21/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/17/jdk/alpine/3.21/entrypoint.sh
+++ b/17/jdk/alpine/3.21/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jdk/alpine/3.22/entrypoint.sh b/17/jdk/alpine/3.22/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/17/jdk/alpine/3.22/entrypoint.sh
+++ b/17/jdk/alpine/3.22/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jdk/alpine/3.23/entrypoint.sh b/17/jdk/alpine/3.23/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/17/jdk/alpine/3.23/entrypoint.sh
+++ b/17/jdk/alpine/3.23/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jdk/alpine/3.24/entrypoint.sh b/17/jdk/alpine/3.24/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/17/jdk/alpine/3.24/entrypoint.sh
+++ b/17/jdk/alpine/3.24/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jdk/ubi/ubi10-minimal/entrypoint.sh b/17/jdk/ubi/ubi10-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/17/jdk/ubi/ubi10-minimal/entrypoint.sh
+++ b/17/jdk/ubi/ubi10-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/17/jdk/ubi/ubi9-minimal/entrypoint.sh b/17/jdk/ubi/ubi9-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/17/jdk/ubi/ubi9-minimal/entrypoint.sh
+++ b/17/jdk/ubi/ubi9-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/17/jdk/ubuntu/jammy/entrypoint.sh b/17/jdk/ubuntu/jammy/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/17/jdk/ubuntu/jammy/entrypoint.sh
+++ b/17/jdk/ubuntu/jammy/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jdk/ubuntu/noble/entrypoint.sh b/17/jdk/ubuntu/noble/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/17/jdk/ubuntu/noble/entrypoint.sh
+++ b/17/jdk/ubuntu/noble/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jdk/ubuntu/resolute/entrypoint.sh b/17/jdk/ubuntu/resolute/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/17/jdk/ubuntu/resolute/entrypoint.sh
+++ b/17/jdk/ubuntu/resolute/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jre/alpine/3.21/entrypoint.sh b/17/jre/alpine/3.21/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/17/jre/alpine/3.21/entrypoint.sh
+++ b/17/jre/alpine/3.21/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jre/alpine/3.22/entrypoint.sh b/17/jre/alpine/3.22/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/17/jre/alpine/3.22/entrypoint.sh
+++ b/17/jre/alpine/3.22/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jre/alpine/3.23/entrypoint.sh b/17/jre/alpine/3.23/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/17/jre/alpine/3.23/entrypoint.sh
+++ b/17/jre/alpine/3.23/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jre/alpine/3.24/entrypoint.sh b/17/jre/alpine/3.24/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/17/jre/alpine/3.24/entrypoint.sh
+++ b/17/jre/alpine/3.24/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jre/ubi/ubi10-minimal/entrypoint.sh b/17/jre/ubi/ubi10-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/17/jre/ubi/ubi10-minimal/entrypoint.sh
+++ b/17/jre/ubi/ubi10-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/17/jre/ubi/ubi9-minimal/entrypoint.sh b/17/jre/ubi/ubi9-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/17/jre/ubi/ubi9-minimal/entrypoint.sh
+++ b/17/jre/ubi/ubi9-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/17/jre/ubuntu/jammy/entrypoint.sh b/17/jre/ubuntu/jammy/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/17/jre/ubuntu/jammy/entrypoint.sh
+++ b/17/jre/ubuntu/jammy/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jre/ubuntu/noble/entrypoint.sh b/17/jre/ubuntu/noble/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/17/jre/ubuntu/noble/entrypoint.sh
+++ b/17/jre/ubuntu/noble/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/17/jre/ubuntu/resolute/entrypoint.sh b/17/jre/ubuntu/resolute/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/17/jre/ubuntu/resolute/entrypoint.sh
+++ b/17/jre/ubuntu/resolute/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jdk/alpine/3.21/entrypoint.sh b/21/jdk/alpine/3.21/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/21/jdk/alpine/3.21/entrypoint.sh
+++ b/21/jdk/alpine/3.21/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jdk/alpine/3.22/entrypoint.sh b/21/jdk/alpine/3.22/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/21/jdk/alpine/3.22/entrypoint.sh
+++ b/21/jdk/alpine/3.22/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jdk/alpine/3.23/entrypoint.sh b/21/jdk/alpine/3.23/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/21/jdk/alpine/3.23/entrypoint.sh
+++ b/21/jdk/alpine/3.23/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jdk/alpine/3.24/entrypoint.sh b/21/jdk/alpine/3.24/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/21/jdk/alpine/3.24/entrypoint.sh
+++ b/21/jdk/alpine/3.24/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jdk/ubi/ubi10-minimal/entrypoint.sh b/21/jdk/ubi/ubi10-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/21/jdk/ubi/ubi10-minimal/entrypoint.sh
+++ b/21/jdk/ubi/ubi10-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/21/jdk/ubi/ubi9-minimal/entrypoint.sh b/21/jdk/ubi/ubi9-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/21/jdk/ubi/ubi9-minimal/entrypoint.sh
+++ b/21/jdk/ubi/ubi9-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/21/jdk/ubuntu/jammy/entrypoint.sh b/21/jdk/ubuntu/jammy/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/21/jdk/ubuntu/jammy/entrypoint.sh
+++ b/21/jdk/ubuntu/jammy/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jdk/ubuntu/noble/entrypoint.sh b/21/jdk/ubuntu/noble/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/21/jdk/ubuntu/noble/entrypoint.sh
+++ b/21/jdk/ubuntu/noble/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jdk/ubuntu/resolute/entrypoint.sh b/21/jdk/ubuntu/resolute/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/21/jdk/ubuntu/resolute/entrypoint.sh
+++ b/21/jdk/ubuntu/resolute/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jre/alpine/3.21/entrypoint.sh b/21/jre/alpine/3.21/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/21/jre/alpine/3.21/entrypoint.sh
+++ b/21/jre/alpine/3.21/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jre/alpine/3.22/entrypoint.sh b/21/jre/alpine/3.22/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/21/jre/alpine/3.22/entrypoint.sh
+++ b/21/jre/alpine/3.22/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jre/alpine/3.23/entrypoint.sh b/21/jre/alpine/3.23/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/21/jre/alpine/3.23/entrypoint.sh
+++ b/21/jre/alpine/3.23/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jre/alpine/3.24/entrypoint.sh b/21/jre/alpine/3.24/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/21/jre/alpine/3.24/entrypoint.sh
+++ b/21/jre/alpine/3.24/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jre/ubi/ubi10-minimal/entrypoint.sh b/21/jre/ubi/ubi10-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/21/jre/ubi/ubi10-minimal/entrypoint.sh
+++ b/21/jre/ubi/ubi10-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/21/jre/ubi/ubi9-minimal/entrypoint.sh b/21/jre/ubi/ubi9-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/21/jre/ubi/ubi9-minimal/entrypoint.sh
+++ b/21/jre/ubi/ubi9-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/21/jre/ubuntu/jammy/entrypoint.sh b/21/jre/ubuntu/jammy/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/21/jre/ubuntu/jammy/entrypoint.sh
+++ b/21/jre/ubuntu/jammy/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jre/ubuntu/noble/entrypoint.sh b/21/jre/ubuntu/noble/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/21/jre/ubuntu/noble/entrypoint.sh
+++ b/21/jre/ubuntu/noble/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/21/jre/ubuntu/resolute/entrypoint.sh b/21/jre/ubuntu/resolute/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/21/jre/ubuntu/resolute/entrypoint.sh
+++ b/21/jre/ubuntu/resolute/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jdk/alpine/3.21/entrypoint.sh b/25/jdk/alpine/3.21/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/25/jdk/alpine/3.21/entrypoint.sh
+++ b/25/jdk/alpine/3.21/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jdk/alpine/3.22/entrypoint.sh b/25/jdk/alpine/3.22/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/25/jdk/alpine/3.22/entrypoint.sh
+++ b/25/jdk/alpine/3.22/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jdk/alpine/3.23/entrypoint.sh b/25/jdk/alpine/3.23/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/25/jdk/alpine/3.23/entrypoint.sh
+++ b/25/jdk/alpine/3.23/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jdk/alpine/3.24/entrypoint.sh b/25/jdk/alpine/3.24/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/25/jdk/alpine/3.24/entrypoint.sh
+++ b/25/jdk/alpine/3.24/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jdk/ubi/ubi10-minimal/entrypoint.sh b/25/jdk/ubi/ubi10-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/25/jdk/ubi/ubi10-minimal/entrypoint.sh
+++ b/25/jdk/ubi/ubi10-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/25/jdk/ubuntu/jammy/entrypoint.sh b/25/jdk/ubuntu/jammy/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/25/jdk/ubuntu/jammy/entrypoint.sh
+++ b/25/jdk/ubuntu/jammy/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jdk/ubuntu/noble/entrypoint.sh b/25/jdk/ubuntu/noble/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/25/jdk/ubuntu/noble/entrypoint.sh
+++ b/25/jdk/ubuntu/noble/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jdk/ubuntu/resolute/entrypoint.sh b/25/jdk/ubuntu/resolute/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/25/jdk/ubuntu/resolute/entrypoint.sh
+++ b/25/jdk/ubuntu/resolute/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jre/alpine/3.21/entrypoint.sh b/25/jre/alpine/3.21/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/25/jre/alpine/3.21/entrypoint.sh
+++ b/25/jre/alpine/3.21/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jre/alpine/3.22/entrypoint.sh b/25/jre/alpine/3.22/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/25/jre/alpine/3.22/entrypoint.sh
+++ b/25/jre/alpine/3.22/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jre/alpine/3.23/entrypoint.sh b/25/jre/alpine/3.23/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/25/jre/alpine/3.23/entrypoint.sh
+++ b/25/jre/alpine/3.23/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jre/alpine/3.24/entrypoint.sh b/25/jre/alpine/3.24/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/25/jre/alpine/3.24/entrypoint.sh
+++ b/25/jre/alpine/3.24/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jre/ubi/ubi10-minimal/entrypoint.sh b/25/jre/ubi/ubi10-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/25/jre/ubi/ubi10-minimal/entrypoint.sh
+++ b/25/jre/ubi/ubi10-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/25/jre/ubuntu/jammy/entrypoint.sh b/25/jre/ubuntu/jammy/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/25/jre/ubuntu/jammy/entrypoint.sh
+++ b/25/jre/ubuntu/jammy/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jre/ubuntu/noble/entrypoint.sh b/25/jre/ubuntu/noble/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/25/jre/ubuntu/noble/entrypoint.sh
+++ b/25/jre/ubuntu/noble/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/25/jre/ubuntu/resolute/entrypoint.sh b/25/jre/ubuntu/resolute/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/25/jre/ubuntu/resolute/entrypoint.sh
+++ b/25/jre/ubuntu/resolute/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/26/jdk/alpine/3.23/entrypoint.sh b/26/jdk/alpine/3.23/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/26/jdk/alpine/3.23/entrypoint.sh
+++ b/26/jdk/alpine/3.23/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/26/jdk/alpine/3.24/entrypoint.sh b/26/jdk/alpine/3.24/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/26/jdk/alpine/3.24/entrypoint.sh
+++ b/26/jdk/alpine/3.24/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/26/jdk/ubi/ubi10-minimal/entrypoint.sh b/26/jdk/ubi/ubi10-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/26/jdk/ubi/ubi10-minimal/entrypoint.sh
+++ b/26/jdk/ubi/ubi10-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/26/jdk/ubuntu/jammy/entrypoint.sh b/26/jdk/ubuntu/jammy/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/26/jdk/ubuntu/jammy/entrypoint.sh
+++ b/26/jdk/ubuntu/jammy/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/26/jdk/ubuntu/noble/entrypoint.sh b/26/jdk/ubuntu/noble/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/26/jdk/ubuntu/noble/entrypoint.sh
+++ b/26/jdk/ubuntu/noble/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/26/jdk/ubuntu/resolute/entrypoint.sh b/26/jdk/ubuntu/resolute/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/26/jdk/ubuntu/resolute/entrypoint.sh
+++ b/26/jdk/ubuntu/resolute/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/26/jre/alpine/3.23/entrypoint.sh b/26/jre/alpine/3.23/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/26/jre/alpine/3.23/entrypoint.sh
+++ b/26/jre/alpine/3.23/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/26/jre/alpine/3.24/entrypoint.sh b/26/jre/alpine/3.24/entrypoint.sh
index f6a155637..35a4fe87a 100644
--- a/26/jre/alpine/3.24/entrypoint.sh
+++ b/26/jre/alpine/3.24/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/26/jre/ubi/ubi10-minimal/entrypoint.sh b/26/jre/ubi/ubi10-minimal/entrypoint.sh
index d5357c732..0fb294889 100644
--- a/26/jre/ubi/ubi10-minimal/entrypoint.sh
+++ b/26/jre/ubi/ubi10-minimal/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/26/jre/ubuntu/jammy/entrypoint.sh b/26/jre/ubuntu/jammy/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/26/jre/ubuntu/jammy/entrypoint.sh
+++ b/26/jre/ubuntu/jammy/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/26/jre/ubuntu/noble/entrypoint.sh b/26/jre/ubuntu/noble/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/26/jre/ubuntu/noble/entrypoint.sh
+++ b/26/jre/ubuntu/noble/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/26/jre/ubuntu/resolute/entrypoint.sh b/26/jre/ubuntu/resolute/entrypoint.sh
index 2371db057..e0446a8f8 100644
--- a/26/jre/ubuntu/resolute/entrypoint.sh
+++ b/26/jre/ubuntu/resolute/entrypoint.sh
@@ -76,7 +76,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -136,12 +139,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jdk/alpine/3.21/entrypoint.sh b/8/jdk/alpine/3.21/entrypoint.sh
index 206355b6c..6c705501a 100644
--- a/8/jdk/alpine/3.21/entrypoint.sh
+++ b/8/jdk/alpine/3.21/entrypoint.sh
@@ -73,7 +73,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -133,12 +136,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jdk/alpine/3.22/entrypoint.sh b/8/jdk/alpine/3.22/entrypoint.sh
index 206355b6c..6c705501a 100644
--- a/8/jdk/alpine/3.22/entrypoint.sh
+++ b/8/jdk/alpine/3.22/entrypoint.sh
@@ -73,7 +73,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -133,12 +136,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jdk/alpine/3.23/entrypoint.sh b/8/jdk/alpine/3.23/entrypoint.sh
index 206355b6c..6c705501a 100644
--- a/8/jdk/alpine/3.23/entrypoint.sh
+++ b/8/jdk/alpine/3.23/entrypoint.sh
@@ -73,7 +73,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -133,12 +136,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jdk/alpine/3.24/entrypoint.sh b/8/jdk/alpine/3.24/entrypoint.sh
index 206355b6c..6c705501a 100644
--- a/8/jdk/alpine/3.24/entrypoint.sh
+++ b/8/jdk/alpine/3.24/entrypoint.sh
@@ -73,7 +73,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -133,12 +136,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jdk/ubi/ubi10-minimal/entrypoint.sh b/8/jdk/ubi/ubi10-minimal/entrypoint.sh
index 7309f3d76..905d997c2 100644
--- a/8/jdk/ubi/ubi10-minimal/entrypoint.sh
+++ b/8/jdk/ubi/ubi10-minimal/entrypoint.sh
@@ -73,7 +73,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -133,12 +136,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/8/jdk/ubi/ubi9-minimal/entrypoint.sh b/8/jdk/ubi/ubi9-minimal/entrypoint.sh
index 7309f3d76..905d997c2 100644
--- a/8/jdk/ubi/ubi9-minimal/entrypoint.sh
+++ b/8/jdk/ubi/ubi9-minimal/entrypoint.sh
@@ -73,7 +73,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -133,12 +136,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/8/jdk/ubuntu/jammy/entrypoint.sh b/8/jdk/ubuntu/jammy/entrypoint.sh
index b5e4e0073..92d736ad1 100644
--- a/8/jdk/ubuntu/jammy/entrypoint.sh
+++ b/8/jdk/ubuntu/jammy/entrypoint.sh
@@ -73,7 +73,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -133,12 +136,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jdk/ubuntu/noble/entrypoint.sh b/8/jdk/ubuntu/noble/entrypoint.sh
index b5e4e0073..92d736ad1 100644
--- a/8/jdk/ubuntu/noble/entrypoint.sh
+++ b/8/jdk/ubuntu/noble/entrypoint.sh
@@ -73,7 +73,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -133,12 +136,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jdk/ubuntu/resolute/entrypoint.sh b/8/jdk/ubuntu/resolute/entrypoint.sh
index b5e4e0073..92d736ad1 100644
--- a/8/jdk/ubuntu/resolute/entrypoint.sh
+++ b/8/jdk/ubuntu/resolute/entrypoint.sh
@@ -73,7 +73,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -133,12 +136,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jre/alpine/3.21/entrypoint.sh b/8/jre/alpine/3.21/entrypoint.sh
index 5dc7715a7..7f4d15fd2 100644
--- a/8/jre/alpine/3.21/entrypoint.sh
+++ b/8/jre/alpine/3.21/entrypoint.sh
@@ -72,7 +72,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -132,12 +135,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jre/alpine/3.22/entrypoint.sh b/8/jre/alpine/3.22/entrypoint.sh
index 5dc7715a7..7f4d15fd2 100644
--- a/8/jre/alpine/3.22/entrypoint.sh
+++ b/8/jre/alpine/3.22/entrypoint.sh
@@ -72,7 +72,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -132,12 +135,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jre/alpine/3.23/entrypoint.sh b/8/jre/alpine/3.23/entrypoint.sh
index 5dc7715a7..7f4d15fd2 100644
--- a/8/jre/alpine/3.23/entrypoint.sh
+++ b/8/jre/alpine/3.23/entrypoint.sh
@@ -72,7 +72,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -132,12 +135,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jre/alpine/3.24/entrypoint.sh b/8/jre/alpine/3.24/entrypoint.sh
index 5dc7715a7..7f4d15fd2 100644
--- a/8/jre/alpine/3.24/entrypoint.sh
+++ b/8/jre/alpine/3.24/entrypoint.sh
@@ -72,7 +72,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -132,12 +135,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jre/ubi/ubi10-minimal/entrypoint.sh b/8/jre/ubi/ubi10-minimal/entrypoint.sh
index 1bd41b6b1..fc7aa3a0c 100644
--- a/8/jre/ubi/ubi10-minimal/entrypoint.sh
+++ b/8/jre/ubi/ubi10-minimal/entrypoint.sh
@@ -72,7 +72,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -132,12 +135,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/8/jre/ubi/ubi9-minimal/entrypoint.sh b/8/jre/ubi/ubi9-minimal/entrypoint.sh
index 1bd41b6b1..fc7aa3a0c 100644
--- a/8/jre/ubi/ubi9-minimal/entrypoint.sh
+++ b/8/jre/ubi/ubi9-minimal/entrypoint.sh
@@ -72,7 +72,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -132,12 +135,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
         fi
         update-ca-trust
     else
diff --git a/8/jre/ubuntu/jammy/entrypoint.sh b/8/jre/ubuntu/jammy/entrypoint.sh
index b85be3dc9..2bc4da293 100644
--- a/8/jre/ubuntu/jammy/entrypoint.sh
+++ b/8/jre/ubuntu/jammy/entrypoint.sh
@@ -72,7 +72,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -132,12 +135,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jre/ubuntu/noble/entrypoint.sh b/8/jre/ubuntu/noble/entrypoint.sh
index b85be3dc9..2bc4da293 100644
--- a/8/jre/ubuntu/noble/entrypoint.sh
+++ b/8/jre/ubuntu/noble/entrypoint.sh
@@ -72,7 +72,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -132,12 +135,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/8/jre/ubuntu/resolute/entrypoint.sh b/8/jre/ubuntu/resolute/entrypoint.sh
index b85be3dc9..2bc4da293 100644
--- a/8/jre/ubuntu/resolute/entrypoint.sh
+++ b/8/jre/ubuntu/resolute/entrypoint.sh
@@ -72,7 +72,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -132,12 +135,7 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # The reason why this is not part of the opt-in is because it leaves open the option to mount certificates at the
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
         fi
         update-ca-certificates
     else
diff --git a/docker_templates/entrypoint.sh.j2 b/docker_templates/entrypoint.sh.j2
index da9115508..e1396c438 100755
--- a/docker_templates/entrypoint.sh.j2
+++ b/docker_templates/entrypoint.sh.j2
@@ -74,7 +74,10 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
     rm -f "$tmp_store"
 
     # Import the additional certificate into JVM truststore
-    find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | sort | while IFS= read -r i; do
+    for i in /certificates/*crt; do
+        if [ ! -f "$i" ]; then
+            continue
+        fi
         tmp_dir=$(mktemp -d)
         BASENAME=$(basename "$i" .crt)
 
@@ -135,19 +138,9 @@ if [ -n "$USE_SYSTEM_CA_CERTS" ]; then
         # system location, for whatever reason.
         if [ -d /certificates ] && [ "$(ls -A /certificates 2>/dev/null)" ]; then
             {%- if os == "ubuntu" or os == "alpine-linux" %}
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/local/share/ca-certificates/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/local/share/ca-certificates/
             {%- elif os == "ubi-minimal" %}
-            find -L /certificates -path '*/..*' -prune -o -type f -name "*crt" -print 2>/dev/null | while IFS= read -r _crt; do
-                _rel="${_crt#/certificates/}"
-                _dst_rel="${_rel//_/__}"
-                _dst_rel="${_dst_rel//\//_}"
-                cp -L "$_crt" "/usr/share/pki/ca-trust-source/anchors/${_dst_rel}"
-            done
+            cp -La /certificates/* /usr/share/pki/ca-trust-source/anchors/
             {%- endif %}
         fi
 
@@ -167,4 +160,3 @@ fi
 export JRE_CACERTS_PATH
 
 exec "$@"
-
diff --git a/test_generate_dockerfiles.py b/test_generate_dockerfiles.py
index d19de5c76..6bf6720d3 100644
--- a/test_generate_dockerfiles.py
+++ b/test_generate_dockerfiles.py
@@ -192,6 +192,9 @@ def test_entrypoint_rendering(self):
 
         # Ensure that the entrypoint script contains expected commands
         self.assertIn("update-ca-certificates", rendered_template)
+        self.assertIn("/certificates/*crt", rendered_template)
+        self.assertNotIn("/certificates/*.crt", rendered_template)
+        self.assertIn("cp -La /certificates/* /usr/local/share/ca-certificates/", rendered_template)
         self.assertIn("exec \"$@\"", rendered_template)