diff --git a/internal/kms/kes.go b/internal/kms/kes.go
index 21107467f..6ff4dfe87 100644
--- a/internal/kms/kes.go
+++ b/internal/kms/kes.go
@@ -126,8 +126,8 @@ func NewWithConfig(config Config) (KMS, error) {
 		if config.Certificate == nil || config.ReloadCertEvents == nil {
 			return
 		}
+		var prevCertificate tls.Certificate
 		for {
-			var prevCertificate tls.Certificate
 			certificate, ok := <-config.ReloadCertEvents
 			if !ok {
 				return