diff --git a/deployment/memcached/memcached-container-puppet.yaml b/deployment/memcached/memcached-container-puppet.yaml
index b74182f15c..c6961c4bda 100644
--- a/deployment/memcached/memcached-container-puppet.yaml
+++ b/deployment/memcached/memcached-container-puppet.yaml
@@ -221,16 +221,6 @@ outputs:
                     source: {get_param: MemcachedIpSubnet}
             memcached::logstdout: true
             tripleo::profile::base::memcached::enable_internal_memcached_tls: {get_param: MemcachedTLS}
-          -
-            # NOTE: This config is necessary while there are still services
-            # consuming Memcached that do not support TLS. Once all services
-            # do support TLS, this config should be dropped.
-            if:
-            - enable_non_tls_port
-            - memcached_port: {get_param: MemcachedPort}
-              memcached_authtoken_port: 11211
-            - memcached_port: {get_param: MemcachedPort}
-              memcached_authtoken_port: {get_param: MemcachedPort}
           -
             if:
             - internal_tls_enabled
@@ -263,6 +253,16 @@ outputs:
                     - enable_non_tls_port
                     - 11211
                     - {get_param: MemcachedPort}
+      global_config_settings:
+        # NOTE: This config is necessary while there are still services
+        # consuming Memcached that do not support TLS. Once all services
+        # do support TLS, this config should be dropped.
+        if:
+        - enable_non_tls_port
+        - memcached_port: {get_param: MemcachedPort}
+          memcached_authtoken_port: 11211
+        - memcached_port: {get_param: MemcachedPort}
+          memcached_authtoken_port: {get_param: MemcachedPort}
       # BEGIN DOCKER SETTINGS
       puppet_config:
         config_volume: 'memcached'
diff --git a/environments/ssl/enable-memcached-tls.yaml b/environments/ssl/enable-memcached-tls.yaml
index 6f73a8b5ff..2be6acf0cd 100644
--- a/environments/ssl/enable-memcached-tls.yaml
+++ b/environments/ssl/enable-memcached-tls.yaml
@@ -5,6 +5,3 @@
 parameter_defaults:
   MemcachedTLS: true
   MemcachedPort: 11212
-  ExtraConfig:
-    memcached_port: 11212
-    memcached_authtoken_port: 11211