diff --git a/nixos/tests/kanidm-provisioning.nix b/nixos/tests/kanidm-provisioning.nix
index c96e9647b411..3bfdce6c912c 100644
--- a/nixos/tests/kanidm-provisioning.nix
+++ b/nixos/tests/kanidm-provisioning.nix
@@ -4,6 +4,13 @@ import ./make-test-python.nix (
     certs = import ./common/acme/server/snakeoil-certs.nix;
     serverDomain = certs.domain;
 
+    # copy certs to store to work around mount namespacing
+    certsPath = pkgs.runCommandNoCC "snakeoil-certs" { } ''
+      mkdir $out
+      cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
+      cp ${certs."${serverDomain}".key} $out/snakeoil.key
+    '';
+
     provisionAdminPassword = "very-strong-password-for-admin";
     provisionIdmAdminPassword = "very-strong-password-for-idm-admin";
     provisionIdmAdminPassword2 = "very-strong-alternative-password-for-idm-admin";
@@ -23,8 +30,8 @@ import ./make-test-python.nix (
             domain = serverDomain;
             bindaddress = "[::]:443";
             ldapbindaddress = "[::1]:636";
-            tls_chain = certs."${serverDomain}".cert;
-            tls_key = certs."${serverDomain}".key;
+            tls_chain = "${certsPath}/snakeoil.crt";
+            tls_key = "${certsPath}/snakeoil.key";
           };
           # So we can check whether provisioning did what we wanted
           enableClient = true;
diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix
index a2f4b98a728c..7e2fce20857a 100644
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@@ -6,6 +6,13 @@ import ./make-test-python.nix ({ pkgs, ... }:
     testCredentials = {
       password = "Password1_cZPEwpCWvrReripJmAZdmVIZd8HHoHcl";
     };
+
+    # copy certs to store to work around mount namespacing
+    certsPath = pkgs.runCommandNoCC "snakeoil-certs" { } ''
+      mkdir $out
+      cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
+      cp ${certs."${serverDomain}".key} $out/snakeoil.key
+    '';
   in
   {
     name = "kanidm";
@@ -19,8 +26,8 @@ import ./make-test-python.nix ({ pkgs, ... }:
           domain = serverDomain;
           bindaddress = "[::]:443";
           ldapbindaddress = "[::1]:636";
-          tls_chain = certs."${serverDomain}".cert;
-          tls_key = certs."${serverDomain}".key;
+          tls_chain = "${certsPath}/snakeoil.crt";
+          tls_key = "${certsPath}/snakeoil.key";
         };
       };