diff --git a/aosp/update_attempter_android.cc b/aosp/update_attempter_android.cc
index f2ec2a5..4e609d4 100644
--- a/aosp/update_attempter_android.cc
+++ b/aosp/update_attempter_android.cc
@@ -775,7 +775,8 @@
                                        boot_control_,
                                        hardware_,
                                        fetcher,  // passes ownership
-                                       true /* interactive */);
+                                       true /* interactive */,
+                                       update_certificates_path_);
   download_action->set_delegate(this);
   download_action->set_base_offset(base_offset_);
   auto filesystem_verifier_action = std::make_unique<FilesystemVerifierAction>(
diff --git a/aosp/update_attempter_android.h b/aosp/update_attempter_android.h
index 7fa01e8..5d832e0 100644
--- a/aosp/update_attempter_android.h
+++ b/aosp/update_attempter_android.h
@@ -133,6 +133,11 @@
   // 3. When user called |ResetStatus()|
   bool ClearUpdateCompletedMarker();
 
+  void set_update_certificates_path(
+      const std::string& update_certificates_path) {
+    update_certificates_path_ = update_certificates_path;
+  }
+
  private:
   friend class UpdateAttempterAndroidTest;
 
@@ -274,6 +279,9 @@
   // CleanupPreviousUpdateAction has not been executed.
   std::optional<ErrorCode> cleanup_previous_update_code_{std::nullopt};
 
+  // The path to the zip file with X509 certificates.
+  std::string update_certificates_path_{constants::kUpdateCertificatesPath};
+
   DISALLOW_COPY_AND_ASSIGN(UpdateAttempterAndroid);
 };
 
diff --git a/common/download_action.h b/common/download_action.h
index 7b496b1..887dd04 100644
--- a/common/download_action.h
+++ b/common/download_action.h
@@ -77,7 +77,9 @@
                  BootControlInterface* boot_control,
                  HardwareInterface* hardware,
                  HttpFetcher* http_fetcher,
-                 bool interactive);
+                 bool interactive,
+                 std::string update_certs_path = constants::kUpdateCertificatesPath
+                 );
   ~DownloadAction() override;
 
   // InstallPlanAction overrides.
@@ -152,6 +154,9 @@
   // Offset of the payload in the download URL, used by UpdateAttempterAndroid.
   int64_t base_offset_{0};
 
+  // The path to the zip file with X509 certificates.
+  const std::string update_certificates_path_;
+
   DISALLOW_COPY_AND_ASSIGN(DownloadAction);
 };
 
@@ -161,4 +166,4 @@
 
 }  // namespace chromeos_update_engine
 
-#endif  // UPDATE_ENGINE_COMMON_DOWNLOAD_ACTION_H_
+#endif // UPDATE_ENGINE_COMMON_DOWNLOAD_ACTION_H_
diff --git a/download_action.cc b/download_action.cc
index 62a8423..0358569 100644
--- a/download_action.cc
+++ b/download_action.cc
@@ -41,14 +41,16 @@
                                BootControlInterface* boot_control,
                                HardwareInterface* hardware,
                                HttpFetcher* http_fetcher,
-                               bool interactive)
+                               bool interactive,
+                               std::string update_certificates_path)
     : prefs_(prefs),
       boot_control_(boot_control),
       hardware_(hardware),
       http_fetcher_(new MultiRangeHttpFetcher(http_fetcher)),
       interactive_(interactive),
       code_(ErrorCode::kSuccess),
-      delegate_(nullptr) {}
+      delegate_(nullptr),
+      update_certificates_path_(std::move(update_certificates_path)) {}
 
 DownloadAction::~DownloadAction() {}
 
@@ -132,7 +134,8 @@
                                               delegate_,
                                               &install_plan_,
                                               payload_,
-                                              interactive_));
+                                              interactive_,
+                                              update_certificates_path_));
   }
 
   if (install_plan_.is_resume &&
@@ -147,13 +150,15 @@
     if (!LoadCachedManifest(manifest_metadata_size + manifest_signature_size)) {
       if (delta_performer_) {
         // Create a new DeltaPerformer to reset all its state
-        delta_performer_ = std::make_unique<DeltaPerformer>(prefs_,
-                                                            boot_control_,
-                                                            hardware_,
-                                                            delegate_,
-                                                            &install_plan_,
-                                                            payload_,
-                                                            interactive_);
+        delta_performer_ =
+            std::make_unique<DeltaPerformer>(prefs_,
+                                             boot_control_,
+                                             hardware_,
+                                             delegate_,
+                                             &install_plan_,
+                                             payload_,
+                                             interactive_,
+                                             update_certificates_path_);
       }
       http_fetcher_->AddRange(base_offset_,
                               manifest_metadata_size + manifest_signature_size);
diff --git a/payload_consumer/delta_performer.h b/payload_consumer/delta_performer.h
index de6f448..dd71467 100644
--- a/payload_consumer/delta_performer.h
+++ b/payload_consumer/delta_performer.h
@@ -65,19 +65,22 @@
   static const unsigned kProgressOperationsWeight;
   static const uint64_t kCheckpointFrequencySeconds;
 
-  DeltaPerformer(PrefsInterface* prefs,
-                 BootControlInterface* boot_control,
-                 HardwareInterface* hardware,
-                 DownloadActionDelegate* download_delegate,
-                 InstallPlan* install_plan,
-                 InstallPlan::Payload* payload,
-                 bool interactive)
+  DeltaPerformer(
+      PrefsInterface* prefs,
+      BootControlInterface* boot_control,
+      HardwareInterface* hardware,
+      DownloadActionDelegate* download_delegate,
+      InstallPlan* install_plan,
+      InstallPlan::Payload* payload,
+      bool interactive,
+      std::string update_certificates_path = constants::kUpdateCertificatesPath)
       : prefs_(prefs),
         boot_control_(boot_control),
         hardware_(hardware),
         download_delegate_(download_delegate),
         install_plan_(install_plan),
         payload_(payload),
+        update_certificates_path_(std::move(update_certificates_path)),
         interactive_(interactive) {
     CHECK(install_plan_);
   }
@@ -162,11 +165,6 @@
     public_key_path_ = public_key_path;
   }
 
-  void set_update_certificates_path(
-      const std::string& update_certificates_path) {
-    update_certificates_path_ = update_certificates_path;
-  }
-
   // Return true if header parsing is finished and no errors occurred.
   bool IsHeaderParsed() const;
 
@@ -396,7 +394,7 @@
   std::string public_key_path_{constants::kUpdatePayloadPublicKeyPath};
 
   // The path to the zip file with X509 certificates.
-  std::string update_certificates_path_{constants::kUpdateCertificatesPath};
+  const std::string update_certificates_path_;
 
   // The number of bytes received so far, used for progress tracking.
   size_t total_bytes_received_{0};
diff --git a/payload_consumer/delta_performer_integration_test.cc b/payload_consumer/delta_performer_integration_test.cc
index 34e4c90..de948fb 100644
--- a/payload_consumer/delta_performer_integration_test.cc
+++ b/payload_consumer/delta_performer_integration_test.cc
@@ -799,13 +799,13 @@
                                   &state->mock_delegate_,
                                   install_plan,
                                   &install_plan->payloads[0],
-                                  false /* interactive */);
+                                  false /* interactive */,
+                                  "");
   string public_key_path = signature_test == kSignatureGeneratedShellECKey
                                ? GetBuildArtifactsPath(kUnittestPublicKeyECPath)
                                : GetBuildArtifactsPath(kUnittestPublicKeyPath);
   ASSERT_TRUE(utils::FileExists(public_key_path.c_str()));
   (*performer)->set_public_key_path(public_key_path);
-  (*performer)->set_update_certificates_path("");
 
   ASSERT_EQ(
       static_cast<off_t>(state->image_size),
diff --git a/payload_consumer/delta_performer_unittest.cc b/payload_consumer/delta_performer_unittest.cc
index bd4850a..effc8f3 100644
--- a/payload_consumer/delta_performer_unittest.cc
+++ b/payload_consumer/delta_performer_unittest.cc
@@ -167,7 +167,6 @@
     install_plan_.target_slot = 1;
     EXPECT_CALL(mock_delegate_, ShouldCancel(_))
         .WillRepeatedly(testing::Return(false));
-    performer_.set_update_certificates_path("");
     // Set the public key corresponding to the unittest private key.
     string public_key_path = GetBuildArtifactsPath(kUnittestPublicKeyPath);
     EXPECT_TRUE(utils::FileExists(public_key_path.c_str()));
@@ -443,7 +442,8 @@
                             &mock_delegate_,
                             &install_plan_,
                             &payload_,
-                            false /* interactive*/};
+                            false /* interactive */,
+                            "" /* Update certs path */};
 };
 
 TEST_F(DeltaPerformerTest, FullPayloadWriteTest) {