diff --git a/site/profiles/manifests/base.pp b/site/profiles/manifests/base.pp
index d098b7b..647b5ea 100644
--- a/site/profiles/manifests/base.pp
+++ b/site/profiles/manifests/base.pp
@@ -3,6 +3,10 @@ class profiles::base (
   Array  $puppet_servers,
 ) {
 
+  # install the vault ca first
+  include profiles::pki::vaultca
+
+  # manage package repositories
   case $facts['os']['family'] {
     'RedHat': {
       include profiles::yum::global
@@ -34,7 +38,6 @@ class profiles::base (
   include profiles::ntp::client
   include profiles::dns::base
   include profiles::pki::vault
-  include profiles::pki::vaultca
   include profiles::cloudinit::init
   include profiles::metrics::default
   include profiles::helpers::node_lookup
diff --git a/site/profiles/manifests/defaults.pp b/site/profiles/manifests/defaults.pp
index 5c72fb6..1db27c8 100644
--- a/site/profiles/manifests/defaults.pp
+++ b/site/profiles/manifests/defaults.pp
@@ -27,4 +27,8 @@ class profiles::defaults {
     ensure => present,
     shell => '/bin/bash',
   }
+
+  Yumrepo {
+    require => Class['profiles::pki::vaultca'],
+  }
 }