diff --git a/srcpkgs/openjdk-common/INSTALL b/srcpkgs/openjdk-common/INSTALL
index e0e155cc208..89eb436d74b 100644
--- a/srcpkgs/openjdk-common/INSTALL
+++ b/srcpkgs/openjdk-common/INSTALL
@@ -6,4 +6,14 @@ pre)
 		rm "./etc/profile.d/openjdk.sh"
 	fi
 	;;
+post)
+	if [ ! -f ./etc/ssl/certs/java/cacerts ]; then
+		rm -rf ./etc/ssl/certs/java/cacerts
+		mkdir -p ./etc/ssl/certs/java
+		trust extract \
+			--overwrite --filter=ca-anchors \
+			--format=java-cacerts \
+			--purpose server-auth \
+			./etc/ssl/certs/java/cacerts
+	fi
 esac
diff --git a/srcpkgs/openjdk-common/REMOVE b/srcpkgs/openjdk-common/REMOVE
new file mode 100644
index 00000000000..d25538691ea
--- /dev/null
+++ b/srcpkgs/openjdk-common/REMOVE
@@ -0,0 +1,6 @@
+#!/bin/sh
+case "$ACTION" in
+post)
+	rm -f ./etc/ssl/certs/java/cacerts
+	rmdir ./etc/ssl/certs/java >/dev/null
+esac
diff --git a/srcpkgs/openjdk-common/template b/srcpkgs/openjdk-common/template
index 8b0748efaad..118e59f0b6b 100644
--- a/srcpkgs/openjdk-common/template
+++ b/srcpkgs/openjdk-common/template
@@ -1,7 +1,8 @@
 # Template file for 'openjdk-common'
 pkgname=openjdk-common
-version=2
+version=3
 revision=1
+depends="p11-kit"
 short_desc="Common files for OpenJDK packages"
 maintainer="classabbyamp <void@placeviolette.net>"
 license="Public Domain"
@@ -10,4 +11,13 @@ homepage="https://www.voidlinux.org"
 do_install() {
 	vinstall "${FILESDIR}"/profile.sh 644 /etc/profile.d jdk.sh
 	vbin "${FILESDIR}"/java.sh java
+	cat >ca-hooks <<-'_EOF_'
+	#!/bin/sh
+	mkdir -p ./java
+	trust extract \
+	    --overwrite --filter=ca-anchors --format=java-cacerts \
+	    --purpose server-auth \
+	    ./java/cacerts
+	_EOF_
+	vinstall ca-hooks 755 etc/ca-certificates/update.d generate-java-keystore
 }
diff --git a/srcpkgs/openjdk11/template b/srcpkgs/openjdk11/template
index e7d2b2af87b..9fc7c518903 100644
--- a/srcpkgs/openjdk11/template
+++ b/srcpkgs/openjdk11/template
@@ -1,7 +1,7 @@
 # Template file for 'openjdk11'
 pkgname=openjdk11
 version=11.0.25+5
-revision=1
+revision=2
 _java_ver="${version%%.*}"
 _jdk_home="usr/lib/jvm/openjdk${_java_ver}"
 archs="x86_64* i686* aarch64* armv7* ppc64*"
@@ -28,7 +28,7 @@ configure_args="
 make_build_args="images static-libs-image $(vopt_if docs docs)"
 make_check_target="test-hotspot-gtest"
 hostmakedepends="pkg-config automake autoconf cpio tar unzip zip ca-certificates
- openssl zlib-devel which p11-kit"
+ openssl zlib-devel which"
 makedepends="libXrender-devel libXtst-devel libXt-devel libXrandr-devel
  giflib-devel libjpeg-turbo-devel cups-devel freetype-devel alsa-lib-devel
  fontconfig-devel zlib-devel lcms2-devel"
@@ -115,7 +115,7 @@ do_install() {
 	vcopy build/*-normal-*-release/images/jdk/* $_jdk_home
 
 	vmkdir $_jdk_home/lib/security
-	trust extract --overwrite --filter=ca-anchors --format=java-cacerts --purpose server-auth "${DESTDIR}/${_jdk_home}/lib/security/cacerts"
+	ln -fs /etc/ssl/certs/java/cacerts "${DESTDIR}/${_jdk_home}/lib/security"
 
 	vlicense ASSEMBLY_EXCEPTION
 	vlicense LICENSE
diff --git a/srcpkgs/openjdk17/template b/srcpkgs/openjdk17/template
index 3457e15dd8b..00b63adcf00 100644
--- a/srcpkgs/openjdk17/template
+++ b/srcpkgs/openjdk17/template
@@ -1,7 +1,7 @@
 # Template file for 'openjdk17'
 pkgname=openjdk17
 version=17.0.15+2
-revision=1
+revision=2
 _gtest_ver=1.13.0
 _java_ver="${version%%.*}"
 _jdk_update="${version#*+}"
@@ -32,7 +32,7 @@ make_build_args="images static-libs-image $(vopt_if docs docs)"
 make_install_args="INSTALL_PREFIX=\"${DESTDIR}/usr/lib\""
 make_check_target="test-hotspot-gtest"
 hostmakedepends="pkg-config automake autoconf cpio tar unzip zip ca-certificates
- openssl zlib-devel which p11-kit"
+ openssl zlib-devel which"
 makedepends="libXrender-devel libXtst-devel libXt-devel libXrandr-devel
  giflib-devel libjpeg-turbo-devel cups-devel freetype-devel alsa-lib-devel
  fontconfig-devel zlib-devel lcms2-devel"
@@ -132,7 +132,7 @@ post_install() {
 	mv ${DESTDIR}/usr/lib/jvm/openjdk-${_base_version} ${DESTDIR}/$_jdk_home
 	vcopy build/*-release/images/static-libs/lib $_jdk_home
 	vmkdir $_jdk_home/lib/security
-	trust extract --overwrite --filter=ca-anchors --format=java-cacerts --purpose server-auth "${DESTDIR}/${_jdk_home}/lib/security/cacerts"
+	ln -fs /etc/ssl/certs/java/cacerts "${DESTDIR}/${_jdk_home}/lib/security"
 }
 
 subpackages="openjdk17-static-libs openjdk17-src openjdk17-jre openjdk17-doc openjdk17-jmods"
diff --git a/srcpkgs/openjdk21/template b/srcpkgs/openjdk21/template
index fc7f08bd50a..f44e4f6c2a0 100644
--- a/srcpkgs/openjdk21/template
+++ b/srcpkgs/openjdk21/template
@@ -1,7 +1,7 @@
 # Template file for 'openjdk21'
 pkgname=openjdk21
 version=21.0.7+2
-revision=1
+revision=2
 _gtest_ver=1.13.0
 _java_ver="${version%%.*}"
 _jdk_update="${version#*+}"
@@ -32,7 +32,7 @@ make_build_args="images static-libs-image $(vopt_if docs docs)"
 make_install_args="INSTALL_PREFIX=\"${DESTDIR}/usr/lib\""
 make_check_target="test-hotspot-gtest"
 hostmakedepends="pkg-config automake autoconf cpio tar unzip zip ca-certificates
- openssl zlib-devel which p11-kit"
+ openssl zlib-devel which"
 makedepends="libXrender-devel libXtst-devel libXt-devel libXrandr-devel
  giflib-devel libjpeg-turbo-devel cups-devel freetype-devel alsa-lib-devel
  fontconfig-devel zlib-devel lcms2-devel"
@@ -123,7 +123,7 @@ post_install() {
 	mv ${DESTDIR}/usr/lib/jvm/openjdk-${_base_version} ${DESTDIR}/$_jdk_home
 	vcopy build/*-release/images/static-libs/lib $_jdk_home
 	vmkdir $_jdk_home/lib/security
-	trust extract --overwrite --filter=ca-anchors --format=java-cacerts --purpose server-auth "${DESTDIR}/${_jdk_home}/lib/security/cacerts"
+	ln -fs /etc/ssl/certs/java/cacerts "${DESTDIR}/${_jdk_home}/lib/security"
 }
 
 subpackages="openjdk21-static-libs openjdk21-src openjdk21-jre openjdk21-doc openjdk21-jmods"
diff --git a/srcpkgs/openjdk8/template b/srcpkgs/openjdk8/template
index 09e24b3eb01..842929da9d9 100644
--- a/srcpkgs/openjdk8/template
+++ b/srcpkgs/openjdk8/template
@@ -1,7 +1,7 @@
 # Template file for 'openjdk8'
 pkgname=openjdk8
 version=8u332b05
-revision=2
+revision=3
 _jdk_update="${version#*u}"
 _jdk_update="${_jdk_update%b*}"
 _jdk_build="${version#*b}"
@@ -31,7 +31,7 @@ configure_args="
 make_build_args="images $(vopt_if docs docs) COMPILER_WARNINGS_FATAL=false GIT=true"
 make_install_args="GIT=true"
 hostmakedepends="pkg-config automake autoconf cpio tar unzip zip ca-certificates
- zlib-devel p11-kit which"
+ zlib-devel which"
 makedepends="libXrender-devel libXtst-devel libXt-devel libXrandr-devel
  giflib-devel cups-devel freetype-devel alsa-lib-devel fontconfig-devel
  zlib-devel"
@@ -154,7 +154,7 @@ post_install() {
 	done
 
 	vmkdir ${_jdk_home}/lib/security
-	trust extract --overwrite --filter=ca-anchors --format=java-cacerts --purpose server-auth "${DESTDIR}/${_jdk_home}/lib/security/cacerts"
+	ln -fs /etc/ssl/certs/java/cacerts "${DESTDIR}/${_jdk_home}/lib/security"
 
 	vlicense ASSEMBLY_EXCEPTION
 	vlicense LICENSE