diff --git a/src/renderer/frames/root-frame/root-frame.tsx b/src/renderer/frames/root-frame/root-frame.tsx
index f4abe41a3f..21d3600ea8 100644
--- a/src/renderer/frames/root-frame/root-frame.tsx
+++ b/src/renderer/frames/root-frame/root-frame.tsx
@@ -3,7 +3,6 @@
  * Licensed under MIT License. See LICENSE in root directory for more information.
  */
 
-import { injectSystemCAs } from "../../../common/system-ca";
 import React from "react";
 import { Observer } from "mobx-react";
 import { withInjectables } from "@ogre-tools/injectable-react";
@@ -11,9 +10,6 @@ import broadcastThatRootFrameIsRenderedInjectable from "./broadcast-that-root-fr
 import type { RootFrameChildComponent } from "./root-frame-child-component-injection-token";
 import { rootFrameChildComponentInjectionToken } from "./root-frame-child-component-injection-token";
 
-// Todo: remove import-time side-effect.
-injectSystemCAs();
-
 interface Dependencies {
   broadcastThatRootFrameIsRendered: () => void;
   childComponents: RootFrameChildComponent[];
diff --git a/src/renderer/frames/root-frame/setup-system-ca.injectable.ts b/src/renderer/frames/root-frame/setup-system-ca.injectable.ts
new file mode 100644
index 0000000000..ca913a4371
--- /dev/null
+++ b/src/renderer/frames/root-frame/setup-system-ca.injectable.ts
@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) OpenLens Authors. All rights reserved.
+ * Licensed under MIT License. See LICENSE in root directory for more information.
+ */
+import { injectSystemCAs } from "../../../common/system-ca";
+import { getInjectable } from "@ogre-tools/injectable";
+import { beforeFrameStartsInjectionToken } from "../../before-frame-starts/before-frame-starts-injection-token";
+
+const setupSystemCaInjectable = getInjectable({
+  id: "setup-system-ca",
+
+  instantiate: () => ({
+    run: async () => {
+      await injectSystemCAs();
+    },
+  }),
+
+  causesSideEffects: true,
+
+  injectionToken: beforeFrameStartsInjectionToken,
+});
+
+export default setupSystemCaInjectable;
diff --git a/src/renderer/getDiForUnitTesting.tsx b/src/renderer/getDiForUnitTesting.tsx
index 572fa12399..f70f8938cb 100644
--- a/src/renderer/getDiForUnitTesting.tsx
+++ b/src/renderer/getDiForUnitTesting.tsx
@@ -68,6 +68,7 @@ import deleteClusterDialogClusterFrameChildComponentInjectable from "./component
 import kubeObjectDetailsClusterFrameChildComponentInjectable from "./components/kube-object-details/kube-object-details-cluster-frame-child-component.injectable";
 import kubeconfigDialogClusterFrameChildComponentInjectable from "./components/kubeconfig-dialog/kubeconfig-dialog-cluster-frame-child-component.injectable";
 import portForwardDialogClusterFrameChildComponentInjectable from "./port-forward/port-forward-dialog-cluster-frame-child-component.injectable";
+import setupSystemCaInjectable from "./frames/root-frame/setup-system-ca.injectable";
 
 export const getDiForUnitTesting = (opts: { doGeneralOverrides?: boolean } = {}) => {
   const {
@@ -171,6 +172,7 @@ export const getDiForUnitTesting = (opts: { doGeneralOverrides?: boolean } = {})
     // eslint-disable-next-line unused-imports/no-unused-vars-ts
     di.override(clusterStoreInjectable, () => ({ getById: (id): Cluster => ({}) as Cluster }) as ClusterStore);
 
+    di.override(setupSystemCaInjectable, () => ({ run: () => {} }));
     di.override(setupOnApiErrorListenersInjectable, () => ({ run: () => {} }));
     di.override(provideInitialValuesForSyncBoxesInjectable, () => ({ run: () => {} }));