diff --git a/example/actions/revoke-certificate.sh b/example/actions/revoke-certificate.sh
index 37fcce5..ba4f6b6 100755
--- a/example/actions/revoke-certificate.sh
+++ b/example/actions/revoke-certificate.sh
@@ -30,4 +30,7 @@ vault write ${PKI_NAME}/revoke \
 
 CRL_DIR="$AIA_FOLDER/$PKI_NAME/issuer/$ISSUER_ID/crl"
 mkdir -p $CRL_DIR
-vault read -format=raw $PKI_NAME/issuer/$ISSUER_ID/crl/der > $CRL_DIR/der
+# We use `/crl/pem` instead of `/crl/der`, as the latter seems to show inconsistent behavior in its output, see https://github.com/hashicorp/vault/issues/32018
+vault read -format=raw $PKI_NAME/issuer/$ISSUER_ID/crl/pem > $CRL_DIR/pem
+openssl crl -outform der -in $CRL_DIR/pem -out $CRL_DIR/der
+rm $CRL_DIR/pem
diff --git a/src/scripts/orca-protocol/sudoer/export_crls.nix b/src/scripts/orca-protocol/sudoer/export_crls.nix
index 9b36a74..d02f0fb 100644
--- a/src/scripts/orca-protocol/sudoer/export_crls.nix
+++ b/src/scripts/orca-protocol/sudoer/export_crls.nix
@@ -19,7 +19,10 @@ in
               CRL_DIR="$PKI_AIA_DIR/crl"
               mkdir -p $CRL_DIR
               vault read -format=raw ''${PKI_NAME}/issuer/$ISSUER_ID/der > $PKI_AIA_DIR/der
-              vault read -format=raw ''${PKI_NAME}/issuer/$ISSUER_ID/crl/der > $CRL_DIR/der
+              # We use `/crl/pem` instead of `/crl/der`, as the latter seems to show inconsistent behavior in its output, see https://github.com/hashicorp/vault/issues/32018
+              vault read -format=raw ''${PKI_NAME}/issuer/$ISSUER_ID/crl/pem > $CRL_DIR/pem
+              openssl crl -outform der -in $CRL_DIR/pem -out $CRL_DIR/der
+              rm $CRL_DIR/pem
           fi
       done
   done