diff --git a/ansible/roles/keystone/handlers/main.yml b/ansible/roles/keystone/handlers/main.yml
index 3923ebe0a9..26bec8da41 100644
--- a/ansible/roles/keystone/handlers/main.yml
+++ b/ansible/roles/keystone/handlers/main.yml
@@ -51,6 +51,26 @@
       or keystone_paste_ini.changed | bool
       or keystone_container.changed | bool
 
+- name: Restart keystone-ssh container
+  vars:
+    service_name: "keystone-ssh"
+    service: "{{ keystone_services[service_name] }}"
+    config_json: "{{ keystone_config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
+    keystone_ssh_container: "{{ check_keystone_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
+  kolla_docker:
+    action: "recreate_or_restart_container"
+    common_options: "{{ docker_common_options }}"
+    name: "{{ service.container_name }}"
+    image: "{{ service.image }}"
+    volumes: "{{ service.volumes|reject('equalto', '')|list }}"
+  when:
+    - action != "config"
+    - inventory_hostname in groups[service.group]
+    - service.enabled | bool
+    - config_json.changed | bool
+      or keystone_ssh_confs.changed | bool
+      or keystone_ssh_container.changed | bool
+
 - name: Restart keystone-fernet container
   vars:
     service_name: "keystone-fernet"
@@ -75,26 +95,6 @@
       or keystone_fernet_confs.changed | bool
       or keystone_fernet_container.changed | bool
 
-- name: Restart keystone-ssh container
-  vars:
-    service_name: "keystone-ssh"
-    service: "{{ keystone_services[service_name] }}"
-    config_json: "{{ keystone_config_jsons.results|selectattr('item.key', 'equalto', service_name)|first }}"
-    keystone_ssh_container: "{{ check_keystone_containers.results|selectattr('item.key', 'equalto', service_name)|first }}"
-  kolla_docker:
-    action: "recreate_or_restart_container"
-    common_options: "{{ docker_common_options }}"
-    name: "{{ service.container_name }}"
-    image: "{{ service.image }}"
-    volumes: "{{ service.volumes|reject('equalto', '')|list }}"
-  when:
-    - action != "config"
-    - inventory_hostname in groups[service.group]
-    - service.enabled | bool
-    - config_json.changed | bool
-      or keystone_ssh_confs.changed | bool
-      or keystone_ssh_container.changed | bool
-
 - name: Finish keystone database upgrade
   vars:
     service_name: "keystone"