diff --git a/independent-projects/resteasy-reactive/client/runtime/src/main/java/org/jboss/resteasy/reactive/client/impl/ClientBuilderImpl.java b/independent-projects/resteasy-reactive/client/runtime/src/main/java/org/jboss/resteasy/reactive/client/impl/ClientBuilderImpl.java
index 91ce16f5d6125..025bf3e507ed4 100644
--- a/independent-projects/resteasy-reactive/client/runtime/src/main/java/org/jboss/resteasy/reactive/client/impl/ClientBuilderImpl.java
+++ b/independent-projects/resteasy-reactive/client/runtime/src/main/java/org/jboss/resteasy/reactive/client/impl/ClientBuilderImpl.java
@@ -190,9 +190,6 @@ public ClientBuilder clientLogger(ClientLogger clientLogger) {
 
     @Override
     public ClientImpl build() {
-        Buffer keyStore = asBuffer(this.keyStore, keystorePassword);
-        Buffer trustStore = asBuffer(this.trustStore, this.trustStorePassword);
-
         HttpClientOptions options = Optional.ofNullable(configuration.getFromContext(HttpClientOptions.class))
                 .orElseGet(HttpClientOptions::new);
         if (http2) {
@@ -210,6 +207,9 @@ public ClientImpl build() {
             options.setVerifyHost(false);
         }
 
+        char[] effectiveTrustStorePassword = trustStorePassword == null ? EMPTY_CHAR_ARARAY : trustStorePassword;
+        Buffer keyStore = asBuffer(this.keyStore, keystorePassword);
+        Buffer trustStore = asBuffer(this.trustStore, effectiveTrustStorePassword);
         if (keyStore != null || trustStore != null) {
             options = options.setSsl(true);
             if (keyStore != null) {
@@ -221,7 +221,7 @@ public ClientImpl build() {
             if (trustStore != null) {
                 JksOptions jks = new JksOptions();
                 jks.setValue(trustStore);
-                jks.setPassword(trustStorePassword == null ? "" : new String(trustStorePassword));
+                jks.setPassword(new String(effectiveTrustStorePassword));
                 options.setTrustStoreOptions(jks);
             }
         }