diff --git a/rules/dist/gather-rules.json b/rules/dist/gather-rules.json
index 61dbbcc8..69964189 100644
--- a/rules/dist/gather-rules.json
+++ b/rules/dist/gather-rules.json
@@ -202,7 +202,8 @@
       "enabled": true,
       "collectorType": "command_allowlisted",
       "target": "$c = Get-ChildItem Cert:\\LocalMachine\\My; if ($c) { $c | Select-Object Subject, Thumbprint, Issuer, NotBefore, NotAfter, HasPrivateKey | ConvertTo-Json } else { '{\"CertificateCount\": 0}' }",
-      "trigger": "startup",
+      "trigger": "phase_change",
+      "triggerPhase": "FinalizingSetup",
       "outputEventType": "gather_machine_cert_store",
       "outputSeverity": "Info",
       "tags": [