diff --git a/playbooks/group_vars/puppet4.yaml b/playbooks/group_vars/puppet4.yaml
new file mode 100644
index 0000000000..761972c677
--- /dev/null
+++ b/playbooks/group_vars/puppet4.yaml
@@ -0,0 +1 @@
+puppet_install_version: 4
diff --git a/run_all.sh b/run_all.sh
index 6fd8057263..6d3f826e52 100755
--- a/run_all.sh
+++ b/run_all.sh
@@ -88,6 +88,15 @@ start_timer
 timeout -k 2m 120m ansible-playbook -f 50 ${ANSIBLE_PLAYBOOKS}/bootstrap-k8s-nodes.yaml
 send_timer k8s_bootstrap
 
+# Update the puppet version
+# We run this before base because base enforces the specified puppet version
+# but does not transition from an older version to a newer version.
+# This playbook will do the transition if necessary then base will enforce
+# it going forward.
+start_timer
+timeout -k 2m 10m ansible-playbook -f 50 ${ANSIBLE_PLAYBOOKS}/update_puppet_version.yaml
+send_timer update_puppet_version
+
 # Run the base playbook everywhere
 start_timer
 timeout -k 2m 120m ansible-playbook -f 50 ${ANSIBLE_PLAYBOOKS}/base.yaml
@@ -106,11 +115,6 @@ start_timer
 timeout -k 2m 10m ansible-playbook -f 50 -e @/etc/ansible/hosts/gitea-cluster.yaml ${SYSTEM_CONFIG}/kubernetes/gitea/gitea-playbook.yaml
 send_timer gitea_gitea
 
-# Update the puppet version
-start_timer
-timeout -k 2m 10m ansible-playbook -f 50 ${ANSIBLE_PLAYBOOKS}/update_puppet_version.yaml
-send_timer update_puppet_version
-
 # Run the git/gerrit/zuul sequence, since it's important that they all work together
 start_timer
 timeout -k 2m 30m ansible-playbook -f 50 ${ANSIBLE_PLAYBOOKS}/remote_puppet_git.yaml