diff --git a/src/ca_roots.jl b/src/ca_roots.jl
index 7958ecc..7dbfb3f 100644
--- a/src/ca_roots.jl
+++ b/src/ca_roots.jl
@@ -42,7 +42,10 @@ case this function will always return that path (whether it exists or not).
 """
 ca_roots_path()::String = _ca_roots(false)
 
-const BUNDLED_CA_ROOTS = normpath(Sys.BINDIR, "..", "share", "julia", "cert.pem")
+# NOTE: this has to be a function not a constant since the
+# value of Sys.BINDIR changes from build time to run time.
+bundled_ca_roots() =
+    normpath(Sys.BINDIR::String, "..", "share", "julia", "cert.pem")
 
 const LINUX_CA_ROOTS = [
     "/etc/ssl/cert.pem"								    # Alpine Linux
@@ -73,7 +76,7 @@ function system_ca_roots()
             return
         end
         # TODO: extract system certs on Windows & macOS
-        SYSTEM_CA_ROOTS[] = BUNDLED_CA_ROOTS
+        SYSTEM_CA_ROOTS[] = bundled_ca_roots()
     end
     return SYSTEM_CA_ROOTS[]
 end
diff --git a/test/runtests.jl b/test/runtests.jl
index d6a8041..2d383a1 100644
--- a/test/runtests.jl
+++ b/test/runtests.jl
@@ -1,16 +1,17 @@
 include("setup.jl")
 
 @testset "ca_roots" begin
+    @test isfile(bundled_ca_roots())
     withenv(
         "JULIA_SSL_CA_ROOTS_PATH" => nothing,
     ) do
         @test ca_roots_path() isa String
         @test ispath(ca_roots_path())
         if Sys.iswindows() || Sys.isapple()
-            @test ca_roots_path() == BUNDLED_CA_ROOTS
+            @test ca_roots_path() == bundled_ca_roots()
             @test ca_roots() === nothing
         else
-            @test ca_roots_path() != BUNDLED_CA_ROOTS
+            @test ca_roots_path() != bundled_ca_roots()
             @test ca_roots() == ca_roots_path()
         end
         unset = ca_roots(), ca_roots_path()
diff --git a/test/setup.jl b/test/setup.jl
index 2e82efb..eaa16f1 100644
--- a/test/setup.jl
+++ b/test/setup.jl
@@ -1,7 +1,7 @@
 using Test
 using Logging
 using NetworkOptions
-using NetworkOptions: BUNDLED_CA_ROOTS
+using NetworkOptions: bundled_ca_roots
 
 const TEST_URLS = [
     "" # not a valid host name