diff --git a/keystore-truststore-from-tls-secret.dockerfile b/keystore-truststore-from-tls-secret.dockerfile
index 7e7625e559ddabee49af2349a9c6a66312bd3cd0..478b24c8bddb6318d5ce9af86448163d7e6031f9 100644
--- a/keystore-truststore-from-tls-secret.dockerfile
+++ b/keystore-truststore-from-tls-secret.dockerfile
@@ -2,7 +2,7 @@ FROM alpine:3.21
 
 RUN apk add --no-cache openssl openjdk11
 
-COPY --chown=185 src/main/resources/store/keystore-truststore-from-tls-secret.sh /opt/
+COPY --chown=185 scripts/keystore-truststore-from-tls-secret.sh /opt/
 
 VOLUME /store /tls
 USER 185
diff --git a/scripts/fetch-client-tls-secret.sh b/scripts/fetch-client-tls-secret.sh
new file mode 100755
index 0000000000000000000000000000000000000000..93e873542e9a8e061aacfa4ecf9dc45583296873
--- /dev/null
+++ b/scripts/fetch-client-tls-secret.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+set -e
+
+CLIENT_NAME=${CLIENT_NAME:-clienta}
+NAMESPACE=${NAMESPACE:-by-enable-dev}
+TLS_DIR=${CLIENT_NAME}-tls
+
+export IN_CA_CRT="$TLS_DIR"/ca.crt
+export IN_TLS_KEY="$TLS_DIR"/tls.key
+export IN_TLS_CRT="$TLS_DIR"/tls.crt
+
+export OUT_JKS_TRUSTSTORE="$TLS_DIR"/truststore.jks
+export OUT_P12_KEYSTORE="$TLS_DIR"/keystore.p12
+
+fetch_secret_file() {
+  kubectl get secret -n "$NAMESPACE" "xta-test-server-${CLIENT_NAME}-tls-secret" -o jsonpath="$1" | base64 -d
+}
+
+mkdir -p "$TLS_DIR"
+
+fetch_secret_file '{.data.ca\.crt}' > "$IN_CA_CRT"
+fetch_secret_file '{.data.tls\.key}' > "$IN_TLS_KEY"
+fetch_secret_file '{.data.tls\.crt}' > "$IN_TLS_CRT"
+
+exec /bin/sh keystore-truststore-from-tls-secret.sh
+
diff --git a/scripts/fetch-trust-store.sh b/scripts/fetch-server-trust-store.sh
similarity index 100%
rename from scripts/fetch-trust-store.sh
rename to scripts/fetch-server-trust-store.sh
diff --git a/src/main/resources/store/keystore-truststore-from-tls-secret.sh b/scripts/keystore-truststore-from-tls-secret.sh
similarity index 100%
rename from src/main/resources/store/keystore-truststore-from-tls-secret.sh
rename to scripts/keystore-truststore-from-tls-secret.sh