diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml
index 83a194b..b1455d8 100644
--- a/charts/spire/charts/spire-agent/templates/daemonset.yaml
+++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml
@@ -114,9 +114,11 @@ spec:
               {{- else }}
               if [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" ]; then
                 openssl x509 -in {{ printf "%s/kubelet-server-current.pem" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt
-              elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then
+              fi
+              if [ ! -f /hostCert/kubelet.crt ] && [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then
                 openssl x509 -in {{ printf "%s/kubelet.crt" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt
-              else
+              fi
+              if [ ! -f /hostCert/kubelet.crt ]; then
                 {{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }}
                 {{- if $cbh }}
                 URL="https://$KUBELET_ADDR:10250/spec/"
@@ -129,7 +131,7 @@ spec:
                 {{- else }}
                 URL="https://localhost:10250/spec/"
                 {{- end }}
-                curl --capath /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL"
+                curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL"
                 if [ $? -eq 0 ]; then
                   echo Mode detected as apiServerCA.
                   ln -s /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /hostCert/kubelet.crt