diff --git a/src/saml2/sigver.py b/src/saml2/sigver.py
index 01a12a71d..095d99a22 100644
--- a/src/saml2/sigver.py
+++ b/src/saml2/sigver.py
@@ -806,9 +806,10 @@ def validate_signature(self, signedtext, cert_file, cert_type, node_name, node_i
         com_list = [
             self.xmlsec,
             "--verify",
+            "--enabled-key-data",
+            "x509",
             "--enabled-reference-uris",
             "empty,same-doc",
-            "--enabled-key-data",
             "raw-x509-cert",
             f"--pubkey-cert-{cert_type}",
             cert_file,