diff --git a/.github/workflows/_extension_distribution.yml b/.github/workflows/_extension_distribution.yml
index 3c8c3c4..f1f8014 100644
--- a/.github/workflows/_extension_distribution.yml
+++ b/.github/workflows/_extension_distribution.yml
@@ -383,24 +383,31 @@ jobs:
               with:
                   vcpkgGitCommitId: ${{ inputs.vcpkg_commit }}
 
-            - name: Build extension
-              env:
-                  DUCKDB_PLATFORM: ${{ matrix.duckdb_arch }}
-              run: |
-                  make release CURL_LIBRARY=$CURL_LIBRARY CURL_INCLUDE_DIR=$CURL_INCLUDE_DIR
-
             - name: Install SSL Certificates
               run: |
                   @powershell -NoProfile -ExecutionPolicy unrestricted -Command ^
-                      (new-object System.Net.WebClient).Downloadfile( ^
-                          'https://pki.google.com/roots.pem', 'roots.pem')
+                    (New-Object System.Net.WebClient).Downloadfile( ^
+                        'https://pki.google.com/roots.pem', 'C:\\certificates\\roots.pem')
               shell: cmd
 
             - name: Set GRPC_DEFAULT_SSL_ROOTS_FILE_PATH
               run: |
-                  set GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=%cd%\roots.pem
+                  set GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=C:\\certificates\\roots.pem
+              shell: cmd
+
+            - name: Verify SSL Certificates
+              run: |
+                  if not exist C:\\certificates\\roots.pem echo "roots.pem file not found!" && exit 1
+                  echo "roots.pem file downloaded successfully."
               shell: cmd
 
+            - name: Build extension
+              env:
+                  DUCKDB_PLATFORM: ${{ matrix.duckdb_arch }}
+                  GRPC_DEFAULT_SSL_ROOTS_FILE_PATH: ${{ env.GRPC_DEFAULT_SSL_ROOTS_FILE_PATH }}
+              run: |
+                  make release CURL_LIBRARY=$CURL_LIBRARY CURL_INCLUDE_DIR=$CURL_INCLUDE_DIR
+
             - id: 'auth'
               uses: 'google-github-actions/auth@v2'
               with: