diff --git a/rules/gather/GATHER-ID-002.json b/rules/gather/GATHER-ID-002.json
index 15896045..ee02f699 100644
--- a/rules/gather/GATHER-ID-002.json
+++ b/rules/gather/GATHER-ID-002.json
@@ -10,7 +10,8 @@
   "enabled": true,
   "collectorType": "command_allowlisted",
   "target": "$c = Get-ChildItem Cert:\\LocalMachine\\My; if ($c) { $c | Select-Object Subject, Thumbprint, Issuer, NotBefore, NotAfter, HasPrivateKey | ConvertTo-Json } else { '{\"CertificateCount\": 0}' }",
-  "trigger": "startup",
+  "trigger": "phase_change",
+  "triggerPhase": "FinalizingSetup",
   "outputEventType": "gather_machine_cert_store",
   "outputSeverity": "Info",
   "tags": ["identity", "certificates", "machine-store", "powershell"]