diff --git a/payload_consumer/delta_performer.h b/payload_consumer/delta_performer.h
index de6f448..dd71467 100644
--- a/payload_consumer/delta_performer.h
+++ b/payload_consumer/delta_performer.h
@@ -65,19 +65,22 @@
   static const unsigned kProgressOperationsWeight;
   static const uint64_t kCheckpointFrequencySeconds;
 
-  DeltaPerformer(PrefsInterface* prefs,
-                 BootControlInterface* boot_control,
-                 HardwareInterface* hardware,
-                 DownloadActionDelegate* download_delegate,
-                 InstallPlan* install_plan,
-                 InstallPlan::Payload* payload,
-                 bool interactive)
+  DeltaPerformer(
+      PrefsInterface* prefs,
+      BootControlInterface* boot_control,
+      HardwareInterface* hardware,
+      DownloadActionDelegate* download_delegate,
+      InstallPlan* install_plan,
+      InstallPlan::Payload* payload,
+      bool interactive,
+      std::string update_certificates_path = constants::kUpdateCertificatesPath)
       : prefs_(prefs),
         boot_control_(boot_control),
         hardware_(hardware),
         download_delegate_(download_delegate),
         install_plan_(install_plan),
         payload_(payload),
+        update_certificates_path_(std::move(update_certificates_path)),
         interactive_(interactive) {
     CHECK(install_plan_);
   }
@@ -162,11 +165,6 @@
     public_key_path_ = public_key_path;
   }
 
-  void set_update_certificates_path(
-      const std::string& update_certificates_path) {
-    update_certificates_path_ = update_certificates_path;
-  }
-
   // Return true if header parsing is finished and no errors occurred.
   bool IsHeaderParsed() const;
 
@@ -396,7 +394,7 @@
   std::string public_key_path_{constants::kUpdatePayloadPublicKeyPath};
 
   // The path to the zip file with X509 certificates.
-  std::string update_certificates_path_{constants::kUpdateCertificatesPath};
+  const std::string update_certificates_path_;
 
   // The number of bytes received so far, used for progress tracking.
   size_t total_bytes_received_{0};
diff --git a/payload_consumer/delta_performer_integration_test.cc b/payload_consumer/delta_performer_integration_test.cc
index 34e4c90..de948fb 100644
--- a/payload_consumer/delta_performer_integration_test.cc
+++ b/payload_consumer/delta_performer_integration_test.cc
@@ -799,13 +799,13 @@
                                   &state->mock_delegate_,
                                   install_plan,
                                   &install_plan->payloads[0],
-                                  false /* interactive */);
+                                  false /* interactive */,
+                                  "");
   string public_key_path = signature_test == kSignatureGeneratedShellECKey
                                ? GetBuildArtifactsPath(kUnittestPublicKeyECPath)
                                : GetBuildArtifactsPath(kUnittestPublicKeyPath);
   ASSERT_TRUE(utils::FileExists(public_key_path.c_str()));
   (*performer)->set_public_key_path(public_key_path);
-  (*performer)->set_update_certificates_path("");
 
   ASSERT_EQ(
       static_cast<off_t>(state->image_size),
diff --git a/payload_consumer/delta_performer_unittest.cc b/payload_consumer/delta_performer_unittest.cc
index bd4850a..effc8f3 100644
--- a/payload_consumer/delta_performer_unittest.cc
+++ b/payload_consumer/delta_performer_unittest.cc
@@ -167,7 +167,6 @@
     install_plan_.target_slot = 1;
     EXPECT_CALL(mock_delegate_, ShouldCancel(_))
         .WillRepeatedly(testing::Return(false));
-    performer_.set_update_certificates_path("");
     // Set the public key corresponding to the unittest private key.
     string public_key_path = GetBuildArtifactsPath(kUnittestPublicKeyPath);
     EXPECT_TRUE(utils::FileExists(public_key_path.c_str()));
@@ -443,7 +442,8 @@
                             &mock_delegate_,
                             &install_plan_,
                             &payload_,
-                            false /* interactive*/};
+                            false /* interactive */,
+                            "" /* Update certs path */};
 };
 
 TEST_F(DeltaPerformerTest, FullPayloadWriteTest) {