diff --git a/news/13186.bugfix.rst b/news/13186.bugfix.rst
new file mode 100644
index 00000000000..0c60275d2b8
--- /dev/null
+++ b/news/13186.bugfix.rst
@@ -0,0 +1 @@
+Fix regression where truststore would never be used while installing build dependencies.
diff --git a/src/pip/_internal/build_env.py b/src/pip/_internal/build_env.py
index e820dc3d5fb..e8d1aca0d6a 100644
--- a/src/pip/_internal/build_env.py
+++ b/src/pip/_internal/build_env.py
@@ -11,7 +11,6 @@
 from types import TracebackType
 from typing import TYPE_CHECKING, Iterable, List, Optional, Set, Tuple, Type, Union
 
-from pip._vendor.certifi import where
 from pip._vendor.packaging.version import Version
 
 from pip import __file__ as pip_location
@@ -246,8 +245,6 @@ def _install_requirements(
             # target from config file or env var should be ignored
             "--target",
             "",
-            "--cert",
-            finder.custom_cert or where(),
         ]
         if logger.getEffectiveLevel() <= logging.DEBUG:
             args.append("-vv")
@@ -276,6 +273,8 @@ def _install_requirements(
             args.extend(["--proxy", finder.proxy])
         for host in finder.trusted_hosts:
             args.extend(["--trusted-host", host])
+        if finder.custom_cert:
+            args.extend(["--cert", finder.custom_cert])
         if finder.client_cert:
             args.extend(["--client-cert", finder.client_cert])
         if finder.allow_all_prereleases: