public KeyStore getKeyStore() throws CertificateSourceUnavailableException, IOException {
    String useClientCertificate = envProvider.getEnv("GOOGLE_API_USE_CLIENT_CERTIFICATE");
    if ("false".equalsIgnoreCase(useClientCertificate)) {
      throw new CertificateSourceUnavailableException("mTLS is explicitly disabled via GOOGLE_API_USE_CLIENT_CERTIFICATE.");
    }

    // 1. Attempt to load from resolved Config File
    WorkloadCertificateConfiguration workloadCertConfig = null;
    try {
      workloadCertConfig = MtlsUtils.getWorkloadCertificateConfiguration(envProvider, propProvider, certConfigPathOverride);
    } catch (CertificateSourceUnavailableException e) {
      // Config file is simply not present. This is fine, fallback to SPIFFE.
    }

    if (workloadCertConfig != null) {
      File certFile = new File(workloadCertConfig.getCertPath());
      File keyFile = new File(workloadCertConfig.getPrivateKeyPath());
      if (!certFile.isFile() || !keyFile.isFile()) {
        throw new IOException(
            String.format(
                "Certificate configuration exists but referenced files are missing: cert_path=%s, key_path=%s",
                workloadCertConfig.getCertPath(), workloadCertConfig.getPrivateKeyPath()));
      }
      try (InputStream certStream = new FileInputStream(certFile);
          InputStream privateKeyStream = new FileInputStream(keyFile);
          SequenceInputStream certAndPrivateKeyStream = new SequenceInputStream(certStream, privateKeyStream)) {
        return SecurityUtils.createMtlsKeyStore(certAndPrivateKeyStream);
      } catch (Exception e) {
        throw new IOException("X509Provider: Unexpected error loading from config file:", e);
      }
    }

    // 2. Fallback: Load from SPIFFE Credentials
    File spiffeDir = new File(MtlsUtils.spiffeDirectory);
    if (spiffeDir.isDirectory()) {
      File credentialBundle = new File(spiffeDir, MtlsUtils.SPIFFE_CREDENTIAL_BUNDLE_FILE);
      if (credentialBundle.isFile()) {
        try (InputStream bundleStream = new FileInputStream(credentialBundle)) {
          return SecurityUtils.createMtlsKeyStore(bundleStream);
        } catch (Exception e) {
          throw new IOException("X509Provider: Unexpected error loading from SPIFFE bundle:", e);
        }
      }
      
      File certsFile = new File(spiffeDir, MtlsUtils.SPIFFE_CERTIFICATE_FILE);
      File keyFile = new File(spiffeDir, MtlsUtils.SPIFFE_PRIVATE_KEY_FILE);
      if (certsFile.isFile() && keyFile.isFile()) {
        try (InputStream certStream = new FileInputStream(certsFile);
            InputStream privateKeyStream = new FileInputStream(keyFile);
            SequenceInputStream certAndPrivateKeyStream = new SequenceInputStream(certStream, privateKeyStream)) {
          return SecurityUtils.createMtlsKeyStore(certAndPrivateKeyStream);
        } catch (Exception e) {
          throw new IOException("X509Provider: Unexpected error loading from separate SPIFFE files:", e);
        }
      }
    }

    throw new CertificateSourceUnavailableException("mTLS is enabled, but no certificate source was resolved.");
  }

    try {
      X509Provider x509Provider = new X509Provider(
          SystemEnvironmentProvider.getInstance(),
          SystemPropertyProvider.getInstance(),
          null);
      KeyStore mtlsKeyStore = x509Provider.getKeyStore();
      if (mtlsKeyStore != null) {
        transportFactory = new MtlsHttpTransportFactory(mtlsKeyStore);
      }
    } catch (Exception e) {
      // Graceful fallback to standard transport if mTLS initialization fails
    }