diff --git a/lib/cmdlib/node.py b/lib/cmdlib/node.py
index 17007d1f662bb2c2103c9dd7f592a0484d1a9689..07b1b29aa3b9311515e1142a05f65d09a815517f 100644
--- a/lib/cmdlib/node.py
+++ b/lib/cmdlib/node.py
@@ -771,13 +771,6 @@ class LUNodeSetParams(LogicalUnit):
     self.cfg.Update(node, feedback_fn)
 
     if self.new_role != self.old_role:
-      # Tell the node to demote itself, if no longer MC and not offline
-      if self.old_role == self._ROLE_CANDIDATE and \
-          self.new_role != self._ROLE_OFFLINE:
-        msg = self.rpc.call_node_demote_from_mc(node.name).fail_msg
-        if msg:
-          self.LogWarning("Node failed to demote itself: %s", msg)
-
       new_flags = self._R2F[self.new_role]
       for of, nf, desc in zip(self.old_flags, new_flags, self._FLAGS):
         if of != nf:
@@ -785,6 +778,15 @@ class LUNodeSetParams(LogicalUnit):
       (node.master_candidate, node.drained, node.offline) = new_flags
       self.cfg.Update(node, feedback_fn)
 
+      # Tell the node to demote itself, if no longer MC and not offline.
+      # This must be done only after the configuration is updated so that
+      # it's ensured the node won't receive any further configuration updates.
+      if self.old_role == self._ROLE_CANDIDATE and \
+          self.new_role != self._ROLE_OFFLINE:
+        msg = self.rpc.call_node_demote_from_mc(node.name).fail_msg
+        if msg:
+          self.LogWarning("Node failed to demote itself: %s", msg)
+
       # we locked all nodes, we adjust the CP before updating this node
       if self.lock_all:
         AdjustCandidatePool(self, [node.uuid])