diff --git a/salt/common/tools/sbin/so-image-common b/salt/common/tools/sbin/so-image-common
index b99beac24..0d4783ca6 100755
--- a/salt/common/tools/sbin/so-image-common
+++ b/salt/common/tools/sbin/so-image-common
@@ -143,9 +143,12 @@ update_docker_containers() {
       $PROGRESS_CALLBACK $i
     fi
 
-    # use version defined in elasticsearch defaults.yaml if an es container
     if [[ " ${IMAGES_USING_ES_VERSION[*]} " =~ [[:space:]]${i}[[:space:]] ]]; then
+      # use version defined in elasticsearch defaults.yaml if an es container
       local UPDATE_DIR='/tmp/sogh/securityonion'
+      if [ ! -d "$UPDATE_DIR" ]; then
+        UPDATE_DIR=/securityonion
+      fi
       local v1=0
       local v2=0
       if [[ -f "$UPDATE_DIR/salt/elasticsearch/defaults.yaml" ]]; then
@@ -156,8 +159,8 @@ update_docker_containers() {
       fi
       local highest_es_version=$(compare_es_versions "$v1" "$v2")
       local image=$i:$highest_es_version$IMAGE_TAG_SUFFIX
-    # use the so version for the version
     else
+      # use the so version for the version
       local image=$i:$VERSION$IMAGE_TAG_SUFFIX
     fi
     # Pull down the trusted docker image