diff --git a/lib/puppet/provider/java_ks/keytool.rb b/lib/puppet/provider/java_ks/keytool.rb
index 2cd3a70f..59832a09 100644
--- a/lib/puppet/provider/java_ks/keytool.rb
+++ b/lib/puppet/provider/java_ks/keytool.rb
@@ -8,7 +8,7 @@
   desc 'Uses a combination of openssl and keytool to manage Java keystores'
 
   def command_keytool
-    'keytool'
+    @resource[:keytool]
   end
 
   # Keytool can only import a keystore if the format is pkcs12.  Generating and
diff --git a/lib/puppet/type/java_ks.rb b/lib/puppet/type/java_ks.rb
index a60c1abe..52284c12 100644
--- a/lib/puppet/type/java_ks.rb
+++ b/lib/puppet/type/java_ks.rb
@@ -181,6 +181,12 @@ def value=(*values)
     defaultto 120
   end
 
+  newparam(:keytool) do
+    desc 'Path to the keytool executable used by the provider.'
+
+    defaultto 'keytool'
+  end
+
   newparam(:source_password) do
     munge do |value|
       value = value.unwrap if value.respond_to?(:unwrap)
diff --git a/spec/unit/puppet/provider/java_ks/keytool_spec.rb b/spec/unit/puppet/provider/java_ks/keytool_spec.rb
index 57a2f274..47ba664a 100755
--- a/spec/unit/puppet/provider/java_ks/keytool_spec.rb
+++ b/spec/unit/puppet/provider/java_ks/keytool_spec.rb
@@ -59,6 +59,21 @@
     end
   end
 
+  describe '#command_keytool' do
+    it 'uses the keytool parameter default' do
+      allow(provider).to receive(:command_keytool).and_call_original
+
+      expect(provider.command_keytool).to eq('keytool')
+    end
+
+    it 'uses a custom keytool parameter when provided' do
+      allow(provider).to receive(:command_keytool).and_call_original
+      resource[:keytool] = '/usr/lib/jvm/java-17-openjdk/bin/keytool'
+
+      expect(provider.command_keytool).to eq('/usr/lib/jvm/java-17-openjdk/bin/keytool')
+    end
+  end
+
   describe 'when running keystore commands', if: !Puppet.features.microsoft_windows? do
     it 'calls the passed command' do
       cmd = '/bin/echo testing 1 2 3'
diff --git a/spec/unit/puppet/type/java_ks_spec.rb b/spec/unit/puppet/type/java_ks_spec.rb
index 7f241cee..65a72079 100644
--- a/spec/unit/puppet/type/java_ks_spec.rb
+++ b/spec/unit/puppet/type/java_ks_spec.rb
@@ -38,7 +38,7 @@
   end
 
   describe 'when validating attributes' do
-    [:name, :target, :private_key, :private_key_type, :certificate, :password_file, :trustcacerts, :destkeypass, :password_fail_reset, :source_password].each do |param|
+    [:name, :target, :private_key, :private_key_type, :certificate, :password_file, :trustcacerts, :destkeypass, :password_fail_reset, :source_password, :keytool].each do |param|
       it "has a #{param} parameter" do
         expect(described_class.attrtype(param)).to eq(:param)
       end
@@ -214,6 +214,16 @@
         described_class.new(jks)
       }.to raise_error(Puppet::Error, %r{You must provide 'source_password' when using a 'pkcs12' storetype})
     end
+
+    it 'uses keytool as the default :keytool value' do
+      expect(described_class.new(jks_resource)[:keytool]).to eq('keytool')
+    end
+
+    it 'accepts a custom :keytool value' do
+      jks = jks_resource.merge(keytool: '/usr/lib/jvm/java-17-openjdk/bin/keytool')
+
+      expect(described_class.new(jks)[:keytool]).to eq('/usr/lib/jvm/java-17-openjdk/bin/keytool')
+    end
   end
 
   describe 'when ensure is set to latest' do