diff --git a/puppet/services/designate-worker.yaml b/puppet/services/designate-worker.yaml
index af085304cb..810fd818e1 100644
--- a/puppet/services/designate-worker.yaml
+++ b/puppet/services/designate-worker.yaml
@@ -68,16 +68,16 @@ outputs:
       config_settings:
         map_merge:
         - get_attr: [DesignateBase, role_data, config_settings]
-        -
-          if:
-          - designate_workers_zero
-          - {}
-          - designate::worker::workers: {get_param: DesignateWorkers}
-          designate::worker::worker_notify: true
+        - designate::worker::worker_notify: true
           tripleo.bind.firewall_rules:
             '140 bind':
               dport:
                 - 53
                 - 953
+        -
+          if:
+          - designate_workers_zero
+          - {}
+          - designate::worker::workers: {get_param: DesignateWorkers}
       step_config: |
         include tripleo::profile::base::designate::worker