diff --git a/base/server/python/pki/server/deployment/pkiparser.py b/base/server/python/pki/server/deployment/pkiparser.py
index 6fb22cd5576..599f1d57c20 100644
--- a/base/server/python/pki/server/deployment/pkiparser.py
+++ b/base/server/python/pki/server/deployment/pkiparser.py
@@ -666,8 +666,9 @@ def normalize_cert_token(self, name):
         if not token:
             token = self.mdict.get('pki_token_name')
 
-        # normalize token name
-        token = pki.nssdb.normalize_token(token)
+        # DO NOT normalise the token name here, to avoid re-interpreting
+        # the internal token as the default token.  The token name must
+        # be conveyed to the Java SystemConfigService as-is.
 
         # update cert token
         self.mdict[name] = token