diff --git a/setup/so-setup b/setup/so-setup
index d09e8fc35..43619fb68 100755
--- a/setup/so-setup
+++ b/setup/so-setup
@@ -831,6 +831,10 @@ if ! [[ -f $install_opt_file ]]; then
 		fi
 		checkin_at_boot
 		set_initial_firewall_access
+		# run a final highstate before enabling scheduled highstates. 
+		# this will ensure so-elasticsearch-ilm-policy-load and so-elasticsearch-templates-load have a chance to run after elasticfleet is setup
+		info "Running final highstate for setup"
+		logCmd "salt-call state.highstate -l info"
 		logCmd "salt-call schedule.enable -linfo --local"
 		verify_setup
 	else