diff --git a/setup/so-setup b/setup/so-setup
index cdbbf2d80..ab6f4f491 100755
--- a/setup/so-setup
+++ b/setup/so-setup
@@ -552,6 +552,7 @@ if ! [[ -f $install_opt_file ]]; then
 
 		generate_ca
 		generate_ssl
+		logCmd "salt-call state.apply -l info firewall"
 
 		# create these so the registry state can add so-registry to /opt/so/conf/so-status/so-status.conf
 		logCmd "mkdir -p /opt/so/conf/so-status/ "
@@ -564,7 +565,6 @@ if ! [[ -f $install_opt_file ]]; then
 		docker_seed_registry
 		title "Applying the manager state"
 		logCmd "salt-call state.apply -l info manager" 
-		logCmd "salt-call state.apply -l info firewall"
 		logCmd "salt-call state.highstate -l info"
 		add_web_user
 		info "Restarting SOC to pick up initial user"