diff --git a/src/cli/serve/read_keystore.js b/src/cli/serve/read_keystore.js
index 962c708c0d8df..38d0e68bd5c4e 100644
--- a/src/cli/serve/read_keystore.js
+++ b/src/cli/serve/read_keystore.js
@@ -17,14 +17,13 @@
  * under the License.
  */
 
-import path from 'path';
 import { set } from '@elastic/safer-lodash-set';
 
 import { Keystore } from '../../legacy/server/keystore';
-import { getDataPath } from '../../core/server/path';
+import { getKeystore } from '../../cli_keystore/get_keystore';
 
-export function readKeystore(dataPath = getDataPath()) {
-  const keystore = new Keystore(path.join(dataPath, 'kibana.keystore'));
+export function readKeystore(keystorePath = getKeystore()) {
+  const keystore = new Keystore(keystorePath);
   keystore.load();
 
   const keys = Object.keys(keystore.data);
diff --git a/src/cli/serve/read_keystore.test.js b/src/cli/serve/read_keystore.test.js
index b77e51fc3033a..e5407b257a909 100644
--- a/src/cli/serve/read_keystore.test.js
+++ b/src/cli/serve/read_keystore.test.js
@@ -40,11 +40,17 @@ describe('cli/serve/read_keystore', () => {
     });
   });
 
-  it('uses data path provided', () => {
-    const keystoreDir = '/foo/';
-    const keystorePath = path.join(keystoreDir, 'kibana.keystore');
+  it('uses data path if provided', () => {
+    const keystorePath = path.join('/foo/', 'kibana.keystore');
 
-    readKeystore(keystoreDir);
-    expect(Keystore.mock.calls[0][0]).toEqual(keystorePath);
+    readKeystore(keystorePath);
+    expect(Keystore.mock.calls[0][0]).toContain(keystorePath);
+  });
+
+  it('uses the getKeystore path if not', () => {
+    readKeystore();
+    // we test exact path scenarios in get_keystore.test.js - we use both
+    // deprecated and new to cover any older local environments
+    expect(Keystore.mock.calls[0][0]).toMatch(/data|config/);
   });
 });