diff --git a/rpm_spec/core-appvm.spec b/rpm_spec/core-appvm.spec
index 5961b0a..247e9fb 100644
--- a/rpm_spec/core-appvm.spec
+++ b/rpm_spec/core-appvm.spec
@@ -80,17 +80,17 @@ cp /etc/qubes_eventd_serial /etc/event.d/serial
 
 %post
 
+if [ "$1" !=  1 ] ; then
+# do this whole %post thing only when updating for the first time...
+exit 0
+fi
+
 usermod -L root
 usermod -L user
 if ! [ -f /var/lib/qubes/serial.orig ] ; then
 	cp /etc/event.d/serial /var/lib/qubes/serial.orig
 fi
 
-if [ "$1" !=  1 ] ; then
-# do this whole %post thing only when updating for the first time...
-exit 0
-fi
-
 echo "--> Disabling SELinux..."
 sed -e s/^SELINUX=.*$/SELINUX=disabled/ </etc/selinux/config >/etc/selinux/config.processed
 mv /etc/selinux/config.processed /etc/selinux/config
diff --git a/rpm_spec/core-netvm.spec b/rpm_spec/core-netvm.spec
index 73b7893..6522216 100644
--- a/rpm_spec/core-netvm.spec
+++ b/rpm_spec/core-netvm.spec
@@ -73,6 +73,11 @@ cp /etc/qubes_eventd_serial /etc/event.d/serial
 
 %post
 
+if [ "$1" !=  1 ] ; then
+# do this whole %post thing only when updating for the first time...
+exit 0
+fi
+
 sed 's/^net.ipv4.ip_forward.*/net.ipv4.ip_forward = 1/'  -i /etc/sysctl.conf
 usermod -L root
 usermod -L user
@@ -80,11 +85,6 @@ if ! [ -f /var/lib/qubes/serial.orig ] ; then
        cp /etc/event.d/serial /var/lib/qubes/serial.orig
 fi
 
-if [ "$1" !=  1 ] ; then
-# do this whole %post thing only when updating for the first time...
-exit 0
-fi
-
 echo "--> Disabling SELinux..."
 sed -e s/^SELINUX=.*$/SELINUX=disabled/ </etc/selinux/config >/etc/selinux/config.processed
 mv /etc/selinux/config.processed /etc/selinux/config