diff --git a/README.md b/README.md
index 0651687..fd4507e 100644
--- a/README.md
+++ b/README.md
@@ -335,6 +335,9 @@ build tool can authenticate with a `PAT`. Use the `with.github_token` field to a
 
 `with.mvn_opts` - (optional) additional maven options in a comma-delimited string.
 
+**NB!**  
+Currently only supports the maven command cli option `-s`, specifying a settings.xml file.
+
 Useful when your project depends on a custom maven settings file or use dependencies from a private repository.
 
 If project depends on dependencies from a private repository, actor need to set GitHub [private token](#access-private-repositories) with proper access right.
@@ -343,7 +346,7 @@ If project depends on dependencies from a private repository, actor need to set
  - name: Generate provenance, sign and upload image
    uses: nais/salsa@v0.x
    with:
-     mvn_opts: "-s ./.mvn/settings.xml, -Dmaven.repo.local=/path/to/local/repo"
+     mvn_opts: "-s .mvn/settings.xml"
      github_token: ${{ secrets.PAT }}
 ```
 
diff --git a/pkg/build/jvm/mvn.go b/pkg/build/jvm/mvn.go
index 2537860..e1fabbb 100644
--- a/pkg/build/jvm/mvn.go
+++ b/pkg/build/jvm/mvn.go
@@ -52,6 +52,7 @@ func (m Maven) ResolveDeps(workDir string) (*build.ArtifactDependencies, error)
 	if err != nil {
 		return nil, fmt.Errorf("scan: %v\n", err)
 	}
+
 	args := make([]string, 0)
 	args = append(args, cmd.Name)
 	args = append(args, cmd.SubCmd)
@@ -74,7 +75,7 @@ func (m Maven) parsedCmdOpts() []string {
 
 	parsed := strings.Split(m.CmdOptions, ",")
 	for i, s := range parsed {
-		parsed[i] = strings.TrimSpace(s)
+		parsed[i] = strings.ReplaceAll(s, " ", "")
 	}
 
 	return parsed
diff --git a/pkg/build/jvm/mvn_test.go b/pkg/build/jvm/mvn_test.go
index a0b3259..b2fa8c0 100644
--- a/pkg/build/jvm/mvn_test.go
+++ b/pkg/build/jvm/mvn_test.go
@@ -50,8 +50,8 @@ func TestBuildMaven(t *testing.T) {
 		},
 		{
 			Name:      "Add additional command line arguments as a part of the mvn command",
-			BuildType: BuildMaven("-q, -am, -X,-B, -D yolo=molo"),
-			Cmd:       "mvn dependency:copy-dependencies -DincludeScope=runtime -Dmdep.useRepositoryLayout=true -q -am -X -B -D yolo=molo",
+			BuildType: BuildMaven("-s .m2/maven-settings.xml"),
+			Cmd:       "mvn dependency:copy-dependencies -DincludeScope=runtime -Dmdep.useRepositoryLayout=true -s.m2/maven-settings.xml",
 			WorkDir:   "testdata/jvm/maven",
 			BuildPath: "/usr/local/bin/mvn",
 			Want: test.Want{
diff --git a/pkg/build/jvm/testdata/jvm/maven/.m2/maven-settings.xml b/pkg/build/jvm/testdata/jvm/maven/.m2/maven-settings.xml
new file mode 100644
index 0000000..cb0de86
--- /dev/null
+++ b/pkg/build/jvm/testdata/jvm/maven/.m2/maven-settings.xml
@@ -0,0 +1,14 @@
+<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
+                      http://maven.apache.org/xsd/settings-1.0.0.xsd">
+
+    <servers>
+        <server>
+            <id>github</id>
+            <username>${GITHUB_USERNAME}</username>
+            <password>${GITHUB_TOKEN}</password>
+        </server>
+    </servers>
+
+</settings>
\ No newline at end of file
diff --git a/pkg/build/jvm/testdata/jvm/maven/target/dependency/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar b/pkg/build/jvm/testdata/jvm/maven/target/dependency/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar
new file mode 100644
index 0000000..4765c4a
Binary files /dev/null and b/pkg/build/jvm/testdata/jvm/maven/target/dependency/com/google/code/gson/gson/2.8.6/gson-2.8.6.jar differ
diff --git a/pkg/build/jvm/testdata/jvm/maven/target/dependency/com/google/code/gson/gson/maven-metadata-local.xml b/pkg/build/jvm/testdata/jvm/maven/target/dependency/com/google/code/gson/gson/maven-metadata-local.xml
new file mode 100644
index 0000000..0d11e7f
--- /dev/null
+++ b/pkg/build/jvm/testdata/jvm/maven/target/dependency/com/google/code/gson/gson/maven-metadata-local.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata>
+  <groupId>com.google.code.gson</groupId>
+  <artifactId>gson</artifactId>
+  <versioning>
+    <release>2.8.6</release>
+    <versions>
+      <version>2.8.6</version>
+    </versions>
+    <lastUpdated>20221116003142</lastUpdated>
+  </versioning>
+</metadata>