diff --git a/lib/openssl/ssl.rb b/lib/openssl/ssl.rb
index 2186f5f43..1e1080408 100644
--- a/lib/openssl/ssl.rb
+++ b/lib/openssl/ssl.rb
@@ -90,9 +90,11 @@ class SSLContext
         )
       end
 
-      DEFAULT_CERT_STORE = OpenSSL::X509::Store.new # :nodoc:
-      DEFAULT_CERT_STORE.set_default_paths
-      DEFAULT_CERT_STORE.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
+      DEFAULT_CERT_STORE = OpenSSL::X509::Store.new.tap do |store| # :nodoc:
+        store.set_default_paths
+        store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
+        store.freeze
+      end
 
       # A callback invoked when DH parameters are required for ephemeral DH key
       # exchange.