diff --git a/cli/command/cli.go b/cli/command/cli.go
index 47e9bdfffab0..3208a790417e 100644
--- a/cli/command/cli.go
+++ b/cli/command/cli.go
@@ -209,24 +209,23 @@ func (cli *DockerCli) Initialize(opts *cliflags.ClientOptions, ops ...Initialize
 
 	cli.configFile = cliconfig.LoadDefaultConfigFile(cli.err)
 
-	if cli.client == nil {
-		cli.contextStore = store.New(cliconfig.ContextStoreDir(), cli.contextStoreConfig)
-		cli.currentContext, err = resolveContextName(opts.Common, cli.configFile, cli.contextStore)
-		if err != nil {
-			return err
-		}
-		endpoint, err := resolveDockerEndpoint(cli.contextStore, cli.currentContext, opts.Common)
-		if err != nil {
-			return errors.Wrap(err, "unable to resolve docker endpoint")
-		}
-		cli.dockerEndpoint = endpoint
+	cli.contextStore = store.New(cliconfig.ContextStoreDir(), cli.contextStoreConfig)
+	cli.currentContext, err = resolveContextName(opts.Common, cli.configFile, cli.contextStore)
+	if err != nil {
+		return err
+	}
+	cli.dockerEndpoint, err = resolveDockerEndpoint(cli.contextStore, cli.currentContext, opts.Common)
+	if err != nil {
+		return errors.Wrap(err, "unable to resolve docker endpoint")
+	}
 
-		cli.client, err = newAPIClientFromEndpoint(endpoint, cli.configFile)
+	if cli.client == nil {
+		cli.client, err = newAPIClientFromEndpoint(cli.dockerEndpoint, cli.configFile)
 		if tlsconfig.IsErrEncryptedKey(err) {
 			passRetriever := passphrase.PromptRetrieverWithInOut(cli.In(), cli.Out(), nil)
 			newClient := func(password string) (client.APIClient, error) {
-				endpoint.TLSPassword = password
-				return newAPIClientFromEndpoint(endpoint, cli.configFile)
+				cli.dockerEndpoint.TLSPassword = password
+				return newAPIClientFromEndpoint(cli.dockerEndpoint, cli.configFile)
 			}
 			cli.client, err = getClientWithPassword(passRetriever, newClient)
 		}
diff --git a/cli/command/cli_test.go b/cli/command/cli_test.go
index 0bbe6df05528..926d43f2ddf7 100644
--- a/cli/command/cli_test.go
+++ b/cli/command/cli_test.go
@@ -295,3 +295,12 @@ func TestNewDockerCliAndOperators(t *testing.T) {
 	assert.NilError(t, err)
 	assert.Equal(t, string(errStream), "error")
 }
+
+func TestInitializeShouldAlwaysCreateTheContextStore(t *testing.T) {
+	cli, err := NewDockerCli()
+	assert.NilError(t, err)
+	assert.NilError(t, cli.Initialize(flags.NewClientOptions(), WithInitializeClient(func(cli *DockerCli) (client.APIClient, error) {
+		return client.NewClientWithOpts()
+	})))
+	assert.Check(t, cli.ContextStore() != nil)
+}
diff --git a/e2e/cli-plugins/dial_test.go b/e2e/cli-plugins/dial_test.go
index a01feb034539..9953f3a7a8a7 100644
--- a/e2e/cli-plugins/dial_test.go
+++ b/e2e/cli-plugins/dial_test.go
@@ -18,9 +18,9 @@ func TestDialStdio(t *testing.T) {
 	// follows. We observe this from the debug level logging from
 	// the connhelper stuff.
 	helloworld := filepath.Join(os.Getenv("DOCKER_CLI_E2E_PLUGINS_EXTRA_DIRS"), "docker-helloworld")
-	cmd := icmd.Command(helloworld, "--config=blah", "--tls", "--log-level", "debug", "helloworld", "--who=foo")
+	cmd := icmd.Command(helloworld, "--config=blah", "--log-level", "debug", "helloworld", "--who=foo")
 	res := icmd.RunCmd(cmd, icmd.WithEnv(manager.ReexecEnvvar+"=/bin/true"))
 	res.Assert(t, icmd.Success)
-	assert.Assert(t, is.Contains(res.Stderr(), `msg="commandconn: starting /bin/true with [--config=blah --tls --log-level debug system dial-stdio]"`))
+	assert.Assert(t, is.Contains(res.Stderr(), `msg="commandconn: starting /bin/true with [--config=blah --log-level debug system dial-stdio]"`))
 	assert.Assert(t, is.Equal(res.Stdout(), "Hello foo!\n"))
 }