diff --git a/e2e/vaultsecrets/vaultsecrets_test.go b/e2e/vaultsecrets/vaultsecrets_test.go
index 8ee9f0e2b..902f9b673 100644
--- a/e2e/vaultsecrets/vaultsecrets_test.go
+++ b/e2e/vaultsecrets/vaultsecrets_test.go
@@ -107,10 +107,6 @@ func TestVaultSecrets(t *testing.T) {
 	writePolicy(t, policyID, "./input/policy-good.hcl", testID)
 	submission.Rerun(jobs3.ReplaceInJobSpec("FIRST", "SECOND"))
 
-	// record the rough start of vault lease TTL window, so that we don't have
-	// to wait excessively later on
-	ttlStart := time.Now()
-
 	// job should be now unblocked
 	err = e2e.WaitForAllocStatusExpected(jobID, ns, []string{"running", "complete"})
 	must.NoError(t, err, must.Sprint("expected running->complete allocation"))
@@ -118,6 +114,10 @@ func TestVaultSecrets(t *testing.T) {
 	renderedCert := waitForAllocSecret(t, submission, "/secrets/certificate.crt", "BEGIN CERTIFICATE")
 	waitForAllocSecret(t, submission, "/secrets/access.key", secretValue)
 
+	// record the earliest we can guaranteee that the vault lease TTL has
+	// started, so we don't have to wait excessively later on
+	ttlStart := time.Now()
+
 	var re = regexp.MustCompile(`VAULT_TOKEN=(.*)`)
 
 	// check vault token was written and save it for later comparison