diff --git a/hieradata/roles/infra/puppet/master.yaml b/hieradata/roles/infra/puppet/master.yaml
index a562598..6e3155b 100644
--- a/hieradata/roles/infra/puppet/master.yaml
+++ b/hieradata/roles/infra/puppet/master.yaml
@@ -31,7 +31,7 @@ profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-
 # Deep-merged with the entries in roles/infra/puppet.yaml.
 profiles::packages::include:
   encapic:
-    ensure: '0.2.0'
+    ensure: '0.4.0'
   certmanager:
     ensure: '0.2.0'
   sshsignhost:
diff --git a/site/profiles/manifests/puppet/encapic.pp b/site/profiles/manifests/puppet/encapic.pp
index ecb0ed5..eb5edfc 100644
--- a/site/profiles/manifests/puppet/encapic.pp
+++ b/site/profiles/manifests/puppet/encapic.pp
@@ -5,14 +5,14 @@
 # config so the encapi endpoint can change without repackaging.
 class profiles::puppet::encapic (
   Stdlib::HTTPUrl       $encapi_url,
-  Stdlib::AbsolutePath  $config_dir = '/etc/encapic',
+  Stdlib::AbsolutePath  $config_dir = '/etc/encapi',
   String                $config_name = 'encapic.conf',
   String                $owner = 'root',
   String                $group = 'root',
 ) {
 
-  # The RPM ships this file as %config(noreplace), so puppet must write it only
-  # once the package is present or the install overwrites it.
+  # encapic >= 0.4.0 reads this path ahead of the RPM-owned /etc/encapic one;
+  # order after the package so the shim exists before the config does.
   file { $config_dir:
     ensure  => directory,
     mode    => '0755',