diff --git a/pesign-test-app.spec b/pesign-test-app.spec
index e36bd08..e6d6ae1 100644
--- a/pesign-test-app.spec
+++ b/pesign-test-app.spec
@@ -52,9 +52,9 @@ getfacl /run/pesign/socket || :
 #%%define pe_signing_cert Fedora Secure Boot Signer
 if true ; then
 	cp %{name}-unsigned.efi bzImage.signed
-	%pesign -s -i bzImage.signed -o bzImage.signed -a redhatsecurebootca1.cer -c redhatsecureboot301.cer -n redhatsecureboot301
-	%define pe_signing_cert /CN=Fedora Secure Boot Signer
 	%pesign -s -i bzImage.signed -o bzImage.signed -a redhatsecurebootca5.cer -c redhatsecureboot501.cer -n redhatsecureboot501
+	%define pe_signing_cert /CN=Fedora Secure Boot Signer
+	%pesign -s -i bzImage.signed -o bzImage.signed -a redhatsecurebootca1.cer -c redhatsecureboot301.cer -n redhatsecureboot301
 	mv bzImage.signed %{name}-signed.efi
 else
 	cp %{name}-unsigned.efi %{name}-unsigned.0.efi