diff --git a/distribution/src/bin/elasticsearch-cli b/distribution/src/bin/elasticsearch-cli
new file mode 100644
index 0000000000000..94f8f763bb1c6
--- /dev/null
+++ b/distribution/src/bin/elasticsearch-cli
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+set -e -o pipefail
+
+source "`dirname "$0"`"/elasticsearch-env
+
+IFS=';' read -r -a additional_sources <<< "$ES_ADDITIONAL_SOURCES"
+for additional_source in "${additional_sources[@]}"
+do
+  source "`dirname "$0"`"/$additional_source
+done
+
+exec \
+  "$JAVA" \
+  $ES_JAVA_OPTS \
+  -Des.path.home="$ES_HOME" \
+  -Des.path.conf="$ES_PATH_CONF" \
+  -Des.distribution.flavor="$ES_DISTRIBUTION_FLAVOR" \
+  -Des.distribution.type="$ES_DISTRIBUTION_TYPE" \
+  -cp "$ES_CLASSPATH" \
+  $1 \
+  "${@:2}"
diff --git a/distribution/src/bin/elasticsearch-keystore b/distribution/src/bin/elasticsearch-keystore
index aee62dfde50d4..ebe24179a0ea5 100755
--- a/distribution/src/bin/elasticsearch-keystore
+++ b/distribution/src/bin/elasticsearch-keystore
@@ -1,14 +1,5 @@
 #!/bin/bash
 
-source "`dirname "$0"`"/elasticsearch-env
-
-exec \
-  "$JAVA" \
-  $ES_JAVA_OPTS \
-  -Des.path.home="$ES_HOME" \
-  -Des.path.conf="$ES_PATH_CONF" \
-  -Des.distribution.flavor="$ES_DISTRIBUTION_FLAVOR" \
-  -Des.distribution.type="$ES_DISTRIBUTION_TYPE" \
-  -cp "$ES_CLASSPATH" \
+"`dirname "$0"`"/elasticsearch-cli \
   org.elasticsearch.common.settings.KeyStoreCli \
   "$@"
diff --git a/distribution/src/bin/elasticsearch-plugin b/distribution/src/bin/elasticsearch-plugin
index 500fd710c1aea..67b6ea7e13c37 100755
--- a/distribution/src/bin/elasticsearch-plugin
+++ b/distribution/src/bin/elasticsearch-plugin
@@ -1,14 +1,5 @@
 #!/bin/bash
 
-source "`dirname "$0"`"/elasticsearch-env
-
-exec \
-  "$JAVA" \
-  $ES_JAVA_OPTS \
-  -Des.path.home="$ES_HOME" \
-  -Des.path.conf="$ES_PATH_CONF" \
-  -Des.distribution.flavor="$ES_DISTRIBUTION_FLAVOR" \
-  -Des.distribution.type="$ES_DISTRIBUTION_TYPE" \
-  -cp "$ES_CLASSPATH" \
+"`dirname "$0"`"/elasticsearch-cli \
   org.elasticsearch.plugins.PluginCli \
   "$@"
diff --git a/distribution/src/bin/elasticsearch-translog b/distribution/src/bin/elasticsearch-translog
index e176231c6f44d..33350aaf0b65f 100755
--- a/distribution/src/bin/elasticsearch-translog
+++ b/distribution/src/bin/elasticsearch-translog
@@ -1,14 +1,5 @@
 #!/bin/bash
 
-source "`dirname "$0"`"/elasticsearch-env
-
-exec \
-  "$JAVA" \
-  $ES_JAVA_OPTS \
-  -Des.path.home="$ES_HOME" \
-  -Des.path.conf="$ES_PATH_CONF" \
-  -Des.distribution.flavor="$ES_DISTRIBUTION_FLAVOR" \
-  -Des.distribution.type="$ES_DISTRIBUTION_TYPE" \
-  -cp "$ES_CLASSPATH" \
+"`dirname "$0"`"/elasticsearch-cli \
   org.elasticsearch.index.translog.TranslogToolCli \
   "$@"
diff --git a/x-pack/plugin/security/src/main/bin/elasticsearch-certgen b/x-pack/plugin/security/src/main/bin/elasticsearch-certgen
index d56ae2f4d1adb..67d5168452031 100644
--- a/x-pack/plugin/security/src/main/bin/elasticsearch-certgen
+++ b/x-pack/plugin/security/src/main/bin/elasticsearch-certgen
@@ -4,17 +4,7 @@
 # or more contributor license agreements. Licensed under the Elastic License;
 # you may not use this file except in compliance with the Elastic License.
 
-source "`dirname "$0"`"/elasticsearch-env
-
-source "`dirname "$0"`"/x-pack-security-env
-
-exec \
-  "$JAVA" \
-  $ES_JAVA_OPTS \
-  -Des.path.home="$ES_HOME" \
-  -Des.path.conf="$ES_PATH_CONF" \
-  -Des.distribution.flavor="$ES_DISTRIBUTION_FLAVOR" \
-  -Des.distribution.type="$ES_DISTRIBUTION_TYPE" \
-  -cp "$ES_CLASSPATH" \
+ES_ADDITIONAL_SOURCES="x-pack-env;x-pack-security-env" \
+  "`dirname "$0"`"/elasticsearch-cli \
   org.elasticsearch.xpack.core.ssl.CertificateGenerateTool \
   "$@"
diff --git a/x-pack/plugin/security/src/main/bin/elasticsearch-certutil b/x-pack/plugin/security/src/main/bin/elasticsearch-certutil
index c2502bd734ffe..eb245fd0b0ee1 100644
--- a/x-pack/plugin/security/src/main/bin/elasticsearch-certutil
+++ b/x-pack/plugin/security/src/main/bin/elasticsearch-certutil
@@ -4,17 +4,7 @@
 # or more contributor license agreements. Licensed under the Elastic License;
 # you may not use this file except in compliance with the Elastic License.
 
-source "`dirname "$0"`"/elasticsearch-env
-
-source "`dirname "$0"`"/x-pack-security-env
-
-exec \
-  "$JAVA" \
-  $ES_JAVA_OPTS \
-  -Des.path.home="$ES_HOME" \
-  -Des.path.conf="$ES_PATH_CONF" \
-  -Des.distribution.flavor="$ES_DISTRIBUTION_FLAVOR" \
-  -Des.distribution.type="$ES_DISTRIBUTION_TYPE" \
-  -cp "$ES_CLASSPATH" \
+ES_ADDITIONAL_SOURCES="x-pack-env;x-pack-security-env" \
+  "`dirname "$0"`"/elasticsearch-cli \
   org.elasticsearch.xpack.core.ssl.CertificateTool \
   "$@"
diff --git a/x-pack/plugin/security/src/main/bin/elasticsearch-migrate b/x-pack/plugin/security/src/main/bin/elasticsearch-migrate
index eb3c81febdfb7..dc3f360361d9b 100755
--- a/x-pack/plugin/security/src/main/bin/elasticsearch-migrate
+++ b/x-pack/plugin/security/src/main/bin/elasticsearch-migrate
@@ -4,17 +4,7 @@
 # or more contributor license agreements. Licensed under the Elastic License;
 # you may not use this file except in compliance with the Elastic License.
 
-source "`dirname "$0"`"/elasticsearch-env
-
-source "`dirname "$0"`"/x-pack-security-env
-
-exec \
-  "$JAVA" \
-  $ES_JAVA_OPTS \
-  -Des.path.home="$ES_HOME" \
-  -Des.path.conf="$ES_PATH_CONF" \
-  -Des.distribution.flavor="$ES_DISTRIBUTION_FLAVOR" \
-  -Des.distribution.type="$ES_DISTRIBUTION_TYPE" \
-  -cp "$ES_CLASSPATH" \
+ES_ADDITIONAL_SOURCES="x-pack-env;x-pack-security-env" \
+  "`dirname "$0"`"/elasticsearch-cli \
   org.elasticsearch.xpack.security.authc.esnative.ESNativeRealmMigrateTool \
-  "$@"
+  "$@"
\ No newline at end of file
diff --git a/x-pack/plugin/security/src/main/bin/elasticsearch-saml-metadata b/x-pack/plugin/security/src/main/bin/elasticsearch-saml-metadata
index 92200d82e1264..48274ab7efa42 100644
--- a/x-pack/plugin/security/src/main/bin/elasticsearch-saml-metadata
+++ b/x-pack/plugin/security/src/main/bin/elasticsearch-saml-metadata
@@ -4,17 +4,7 @@
 # or more contributor license agreements. Licensed under the Elastic License;
 # you may not use this file except in compliance with the Elastic License.
 
-source "`dirname "$0"`"/elasticsearch-env
-
-source "`dirname "$0"`"/x-pack-security-env
-
-exec \
-  "$JAVA" \
-  $ES_JAVA_OPTS \
-  -Des.path.home="$ES_HOME" \
-  -Des.path.conf="$ES_PATH_CONF" \
-  -Des.distribution.flavor="$ES_DISTRIBUTION_FLAVOR" \
-  -Des.distribution.type="$ES_DISTRIBUTION_TYPE" \
-  -cp "$ES_CLASSPATH" \
+ES_ADDITIONAL_SOURCES="x-pack-env;x-pack-security-env" \
+  "`dirname "$0"`"/elasticsearch-cli \
   org.elasticsearch.xpack.security.authc.saml.SamlMetadataCommand \
   "$@"
diff --git a/x-pack/plugin/security/src/main/bin/elasticsearch-setup-passwords b/x-pack/plugin/security/src/main/bin/elasticsearch-setup-passwords
index e6aaa00d64796..d896efcfcbe28 100644
--- a/x-pack/plugin/security/src/main/bin/elasticsearch-setup-passwords
+++ b/x-pack/plugin/security/src/main/bin/elasticsearch-setup-passwords
@@ -4,17 +4,7 @@
 # or more contributor license agreements. Licensed under the Elastic License;
 # you may not use this file except in compliance with the Elastic License.
 
-source "`dirname "$0"`"/elasticsearch-env
-
-source "`dirname "$0"`"/x-pack-security-env
-
-exec \
-  "$JAVA" \
-  $ES_JAVA_OPTS \
-  -Des.path.home="$ES_HOME" \
-  -Des.path.conf="$ES_PATH_CONF" \
-  -Des.distribution.flavor="$ES_DISTRIBUTION_FLAVOR" \
-  -Des.distribution.type="$ES_DISTRIBUTION_TYPE" \
-  -cp "$ES_CLASSPATH" \
+ES_ADDITIONAL_SOURCES="x-pack-env;x-pack-security-env" \
+  "`dirname "$0"`"/elasticsearch-cli \
   org.elasticsearch.xpack.security.authc.esnative.tool.SetupPasswordTool \
   "$@"
diff --git a/x-pack/plugin/security/src/main/bin/elasticsearch-syskeygen b/x-pack/plugin/security/src/main/bin/elasticsearch-syskeygen
index e8c4f10c044c3..954b0884007ff 100755
--- a/x-pack/plugin/security/src/main/bin/elasticsearch-syskeygen
+++ b/x-pack/plugin/security/src/main/bin/elasticsearch-syskeygen
@@ -4,17 +4,7 @@
 # or more contributor license agreements. Licensed under the Elastic License;
 # you may not use this file except in compliance with the Elastic License.
 
-source "`dirname "$0"`"/elasticsearch-env
-
-source "`dirname "$0"`"/x-pack-security-env
-
-exec \
-  "$JAVA" \
-  $ES_JAVA_OPTS \
-  -Des.path.home="$ES_HOME" \
-  -Des.path.conf="$ES_PATH_CONF" \
-  -Des.distribution.flavor="$ES_DISTRIBUTION_FLAVOR" \
-  -Des.distribution.type="$ES_DISTRIBUTION_TYPE" \
-  -cp "$ES_CLASSPATH" \
+ES_ADDITIONAL_SOURCES="x-pack-env;x-pack-security-env" \
+  "`dirname "$0"`"/elasticsearch-cli \
   org.elasticsearch.xpack.security.crypto.tool.SystemKeyTool \
   "$@"
diff --git a/x-pack/plugin/security/src/main/bin/elasticsearch-users b/x-pack/plugin/security/src/main/bin/elasticsearch-users
index 2d9ed8df93dc4..6caeece8cbccd 100755
--- a/x-pack/plugin/security/src/main/bin/elasticsearch-users
+++ b/x-pack/plugin/security/src/main/bin/elasticsearch-users
@@ -4,17 +4,7 @@
 # or more contributor license agreements. Licensed under the Elastic License;
 # you may not use this file except in compliance with the Elastic License.
 
-source "`dirname "$0"`"/elasticsearch-env
-
-source "`dirname "$0"`"/x-pack-security-env
-
-exec \
-  "$JAVA" \
-  $ES_JAVA_OPTS \
-  -Des.path.home="$ES_HOME" \
-  -Des.path.conf="$ES_PATH_CONF" \
-  -Des.distribution.flavor="$ES_DISTRIBUTION_FLAVOR" \
-  -Des.distribution.type="$ES_DISTRIBUTION_TYPE" \
-  -cp "$ES_CLASSPATH" \
+ES_ADDITIONAL_SOURCES="x-pack-env;x-pack-security-env" \
+  "`dirname "$0"`"/elasticsearch-cli \
   org.elasticsearch.xpack.security.authc.file.tool.UsersTool \
   "$@"
diff --git a/x-pack/plugin/security/src/main/bin/x-pack-security-env b/x-pack/plugin/security/src/main/bin/x-pack-security-env
index 3a2b15e13fa4a..7d8010deec5ea 100644
--- a/x-pack/plugin/security/src/main/bin/x-pack-security-env
+++ b/x-pack/plugin/security/src/main/bin/x-pack-security-env
@@ -4,7 +4,5 @@
 # or more contributor license agreements. Licensed under the Elastic License;
 # you may not use this file except in compliance with the Elastic License.
 
-source "`dirname "$0"`"/x-pack-env
-
 # include x-pack-security jars in classpath
 ES_CLASSPATH="$ES_CLASSPATH:$ES_HOME/modules/x-pack-security/*"
diff --git a/x-pack/plugin/watcher/src/main/bin/elasticsearch-croneval b/x-pack/plugin/watcher/src/main/bin/elasticsearch-croneval
index 6de537660cbc4..c7185d167562c 100755
--- a/x-pack/plugin/watcher/src/main/bin/elasticsearch-croneval
+++ b/x-pack/plugin/watcher/src/main/bin/elasticsearch-croneval
@@ -4,16 +4,7 @@
 # or more contributor license agreements. Licensed under the Elastic License;
 # you may not use this file except in compliance with the Elastic License.
 
-source "`dirname "$0"`"/elasticsearch-env
-
-source "`dirname "$0"`"/x-pack-watcher-env
-
-exec \
-  "$JAVA" \
-  $ES_JAVA_OPTS \
-  -Des.path.home="$ES_HOME" \
-  -Des.path.conf="$ES_PATH_CONF" \
-  -Des.distribution.flavor="$ES_DISTRIBUTION_FLAVOR" \
-  -cp "$ES_CLASSPATH" \
+ES_ADDITIONAL_SOURCES="x-pack-env;x-pack-watcher-env" \
+  "`dirname "$0"`"/elasticsearch-cli \
   org.elasticsearch.xpack.watcher.trigger.schedule.tool.CronEvalTool \
   "$@"
diff --git a/x-pack/plugin/watcher/src/main/bin/x-pack-watcher-env b/x-pack/plugin/watcher/src/main/bin/x-pack-watcher-env
index 13718a01b4330..83045297a0c68 100644
--- a/x-pack/plugin/watcher/src/main/bin/x-pack-watcher-env
+++ b/x-pack/plugin/watcher/src/main/bin/x-pack-watcher-env
@@ -4,7 +4,5 @@
 # or more contributor license agreements. Licensed under the Elastic License;
 # you may not use this file except in compliance with the Elastic License.
 
-source "`dirname "$0"`"/x-pack-env
-
 # include x-pack-security jars in classpath
 ES_CLASSPATH="$ES_CLASSPATH:$ES_HOME/modules/x-pack-watcher/*"