diff --git a/network/qubes-iptables b/network/qubes-iptables
index 55b355d..6daa9ac 100755
--- a/network/qubes-iptables
+++ b/network/qubes-iptables
@@ -44,12 +44,13 @@ start() {
 
     CMD_ARGS=
     if "$CMD-restore" --help 2>&1 | grep -q wait=; then
+        # 'wait' must be last on command line if secs not specified
         CMD_ARGS=--wait
     fi
 
     echo -n $"${CMD}: Applying firewall rules: "
 
-    "$CMD-restore" $CMD_ARGS "$IPTABLES_DATA"
+    "$CMD-restore" "$IPTABLES_DATA" $CMD_ARGS
     ret="$?"
     if [ "$ret" -eq 0 ]; then
         echo OK