diff --git a/hieradata/roles/infra/puppet/master.yaml b/hieradata/roles/infra/puppet/master.yaml
index 6e3155b..32829c7 100644
--- a/hieradata/roles/infra/puppet/master.yaml
+++ b/hieradata/roles/infra/puppet/master.yaml
@@ -31,7 +31,7 @@ profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-
 # Deep-merged with the entries in roles/infra/puppet.yaml.
 profiles::packages::include:
   encapic:
-    ensure: '0.4.0'
+    ensure: '0.5.0'
   certmanager:
     ensure: '0.2.0'
   sshsignhost:
diff --git a/site/profiles/manifests/puppet/encapic.pp b/site/profiles/manifests/puppet/encapic.pp
index eb5edfc..3a2b4ee 100644
--- a/site/profiles/manifests/puppet/encapic.pp
+++ b/site/profiles/manifests/puppet/encapic.pp
@@ -11,7 +11,6 @@ class profiles::puppet::encapic (
   String                $group = 'root',
 ) {
 
-  # encapic >= 0.4.0 reads this path ahead of the RPM-owned /etc/encapic one;
   # order after the package so the shim exists before the config does.
   file { $config_dir:
     ensure  => directory,
@@ -29,4 +28,11 @@ class profiles::puppet::encapic (
     content => "ENCAPI_URL=${encapi_url}\n",
     require => File[$config_dir],
   }
+
+  # legacy pre-0.5.0 config dir; also clears any rpm .rpmsave left behind
+  file { '/etc/encapic':
+    ensure  => absent,
+    force   => true,
+    require => Package['encapic'],
+  }
 }