diff --git a/changelog/@unreleased/pr-2906.v2.yml b/changelog/@unreleased/pr-2906.v2.yml
new file mode 100644
index 000000000..7d3b91258
--- /dev/null
+++ b/changelog/@unreleased/pr-2906.v2.yml
@@ -0,0 +1,6 @@
+type: improvement
+improvement:
+  description: The default CAs are namespaced and accessed via a relative path, allowing
+    the keystores library to be shaded
+  links:
+  - https://github.com/palantir/conjure-java-runtime/pull/2906
diff --git a/keystores/src/main/java/com/palantir/conjure/java/config/ssl/DefaultCas.java b/keystores/src/main/java/com/palantir/conjure/java/config/ssl/DefaultCas.java
index 9733b8c0d..76f999e47 100644
--- a/keystores/src/main/java/com/palantir/conjure/java/config/ssl/DefaultCas.java
+++ b/keystores/src/main/java/com/palantir/conjure/java/config/ssl/DefaultCas.java
@@ -41,7 +41,7 @@ final class DefaultCas {
     /**
      * This is managed by an excavator.
      */
-    private static final String CA_CERTIFICATES_CRT = "/ca-certificates.crt";
+    private static final String CA_CERTIFICATES_CRT = "ca-certificates.crt";
 
     private static final Supplier<Map<String, X509Certificate>> TRUSTED_CERTIFICATES =
             Suppliers.memoize(DefaultCas::getTrustedCertificates);
diff --git a/keystores/src/main/resources/ca-certificates.crt b/keystores/src/main/resources/com/palantir/conjure/java/config/ssl/ca-certificates.crt
similarity index 100%
rename from keystores/src/main/resources/ca-certificates.crt
rename to keystores/src/main/resources/com/palantir/conjure/java/config/ssl/ca-certificates.crt