diff --git a/lib/puppet/application/lookup.rb b/lib/puppet/application/lookup.rb
index e250725ed18..9a2d1586797 100644
--- a/lib/puppet/application/lookup.rb
+++ b/lib/puppet/application/lookup.rb
@@ -9,7 +9,7 @@
 class Puppet::Application::Lookup < Puppet::Application
   RUN_HELP = _("Run 'puppet lookup --help' for more details").freeze
   DEEP_MERGE_OPTIONS = '--knock-out-prefix, --sort-merged-arrays, and --merge-hash-arrays'
-  TRUSTED_INFORMATION_FACTS = %w[hostname domain fqdn clientcert].freeze
+  TRUSTED_INFORMATION_FACTS = %w[hostname domain fqdn].freeze
 
   run_mode :server
 
diff --git a/spec/unit/application/lookup_spec.rb b/spec/unit/application/lookup_spec.rb
index 1a1cd54169e..eae598c6135 100644
--- a/spec/unit/application/lookup_spec.rb
+++ b/spec/unit/application/lookup_spec.rb
@@ -659,7 +659,7 @@ def run_lookup(lookup)
 
           expect {
             lookup.run_command
-          }.to raise_error(/When overriding any of the hostname,domain,fqdn,clientcert facts with #{file_path} given via the --facts flag, they must all be overridden./)
+          }.to raise_error(/When overriding any of the hostname,domain,fqdn facts with #{file_path} given via the --facts flag, they must all be overridden./)
         end
 
         it 'does not fail when all trusted information facts are provided via --facts file' do
@@ -668,6 +668,18 @@ def run_lookup(lookup)
             fqdn: some.fqdn.com
             hostname: some.hostname
             domain: some.domain
+          CONTENT
+          lookup.options[:fact_file] = file_path
+
+          expect {
+            lookup.run_command
+          }.to exit_with(0)
+           .and output(/This is in facts hash/).to_stdout
+        end
+
+        it 'does not fail when clientcert is provided without other trusted facts' do
+          file_path = file_containing('facts.yaml', <<~CONTENT)
+            ---
             clientcert: some.clientcert
           CONTENT
           lookup.options[:fact_file] = file_path