diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index e503234d0..101cbd743 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -1006,12 +1006,6 @@ frontend {{frontend.name}}
 {%           if frontend.ssl_cipherList|default("") != "" %}
 {%             do ssl_options.append('ciphers ' ~ frontend.ssl_cipherList) %}
 {%           endif %}
-{#           # HTTP/2 #}
-{%           if frontend.http2Enabled|default("") == '1' and frontend.advertised_protocols|default("") != "" %}
-{#             # convert protocols to HAProxy-compatible format #}
-{%             set alpn_options = frontend.advertised_protocols|replace('http10', 'http/1.0')|replace('http11', 'http/1.1') %}
-{%             do ssl_options.append('alpn ' ~ alpn_options) %}
-{%           endif %}
 {#           # HSTS #}
 {%           if frontend.ssl_hstsEnabled|default("") == '1' and frontend.mode == 'http' %}
 {%             set hsts_options = [] %}
@@ -1042,6 +1036,12 @@ frontend {{frontend.name}}
 {%             endif %}
 {%           endif %}
 {%         endif %}
+{#         # HTTP/2 with TLS enabled #}
+{%         if frontend.http2Enabled|default("") == '1' and frontend.advertised_protocols|default("") != "" %}
+{#           # convert protocols to HAProxy-compatible format #}
+{%           set alpn_options = frontend.advertised_protocols|replace('http10', 'http/1.0')|replace('http11', 'http/1.1') %}
+{%           do ssl_options.append('alpn ' ~ alpn_options) %}
+{%         endif %}
 {#       # HTTP/2 without TLS #}
 {%       elif frontend.http2Enabled|default("") == '1' and frontend.http2Enabled_nontls|default("") == '1' %}
 {%         do adv_options.append('proto h2') %}