diff --git a/Makefile b/Makefile
index 110d5f48ab9..80a2ea0d876 100644
--- a/Makefile
+++ b/Makefile
@@ -163,7 +163,7 @@ HOST_LD = $(LD)
 HOST_LDXX = $(LDXX)
 
 CPPFLAGS += $(CPPFLAGS_$(CONFIG))
-DEFINES += $(DEFINES_$(CONFIG))
+DEFINES += $(DEFINES_$(CONFIG)) INSTALL_PREFIX=\"$(prefix)\"
 LDFLAGS += $(LDFLAGS_$(CONFIG))
 
 CFLAGS += -std=c89 -pedantic
diff --git a/src/core/security/security_context.c b/src/core/security/security_context.c
index f9fb2407cf9..ec4aa16e794 100644
--- a/src/core/security/security_context.c
+++ b/src/core/security/security_context.c
@@ -60,6 +60,12 @@
   "AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:AES128-"  \
   "SHA256:AES256-SHA256"
 
+#ifndef INSTALL_PREFIX
+static const char *installed_roots_path = "/etc/grpc/roots.pem";
+#else
+static const char *installed_roots_path = INSTALL_PREFIX "/etc/grpc/roots.pem";
+#endif
+
 /* -- Common methods. -- */
 
 grpc_security_status grpc_security_context_create_handshaker(
@@ -404,6 +410,7 @@ static void init_default_pem_root_certs(void) {
     default_pem_root_certs = gpr_load_file(default_root_certs_path, NULL);
     gpr_free(default_root_certs_path);
   }
+  (void) installed_roots_path;
 }
 
 static size_t get_default_pem_roots(const unsigned char **pem_root_certs) {
diff --git a/templates/Makefile.template b/templates/Makefile.template
index f1f1badc16b..3cc1a951926 100644
--- a/templates/Makefile.template
+++ b/templates/Makefile.template
@@ -180,7 +180,7 @@ HOST_LD = $(LD)
 HOST_LDXX = $(LDXX)
 
 CPPFLAGS += $(CPPFLAGS_$(CONFIG))
-DEFINES += $(DEFINES_$(CONFIG))
+DEFINES += $(DEFINES_$(CONFIG)) INSTALL_PREFIX=\"$(prefix)\"
 LDFLAGS += $(LDFLAGS_$(CONFIG))
 
 CFLAGS += -std=c89 -pedantic