diff --git a/cli-auth.c b/cli-auth.c
index 7dc101fb0521b5a4d93879f7a8a99cbacbc7e62d..42c925bf2f16622d6338e358b648e7fa4668c645 100644
--- a/cli-auth.c
+++ b/cli-auth.c
@@ -257,6 +257,16 @@ void cli_auth_try() {
 	}
 #endif
 
+#ifdef ENABLE_CLI_PASSWORD_AUTH
+	if (ses.keys->trans.algo_crypt->cipherdesc == NULL) {
+		fprintf(stderr, "Sorry, I won't let you use password auth unencrypted.\n");
+	} else if (!finished && ses.authstate.authtypes & AUTH_TYPE_PASSWORD) {
+		cli_auth_password();
+		finished = 1;
+		cli_ses.lastauthtype = AUTH_TYPE_PASSWORD;
+	}
+#endif
+
 #ifdef ENABLE_CLI_INTERACT_AUTH
 	if (ses.keys->trans.algo_crypt->cipherdesc == NULL) {
 		fprintf(stderr, "Sorry, I won't let you use interactive auth unencrypted.\n");
@@ -271,16 +281,6 @@ void cli_auth_try() {
 	}
 #endif
 
-#ifdef ENABLE_CLI_PASSWORD_AUTH
-	if (ses.keys->trans.algo_crypt->cipherdesc == NULL) {
-		fprintf(stderr, "Sorry, I won't let you use password auth unencrypted.\n");
-	} else if (!finished && ses.authstate.authtypes & AUTH_TYPE_PASSWORD) {
-		cli_auth_password();
-		finished = 1;
-		cli_ses.lastauthtype = AUTH_TYPE_PASSWORD;
-	}
-#endif
-
 	TRACE(("cli_auth_try lastauthtype %d", cli_ses.lastauthtype))
 
 	if (!finished) {