diff --git a/src/ukify/ukify.py b/src/ukify/ukify.py
index 15e7e10c6f..0b8ef1f217 100755
--- a/src/ukify/ukify.py
+++ b/src/ukify/ukify.py
@@ -2297,6 +2297,12 @@ CONFIG_ITEMS = [
         help='Sign the embedded kernel',
         config_key='UKI/SignKernel',
     ),
+    ConfigItem(
+        '--sign-initrd-pcrs',
+        action=argparse.BooleanOptionalAction,
+        help='additionally sign PCR policies that can only be satisfied from the initrd',
+        config_key='UKI/SignInitrdPCRs',
+    ),
     ConfigItem(
         '--pcr-private-key',
         dest='pcr_private_keys',
@@ -2363,12 +2369,6 @@ CONFIG_ITEMS = [
         action=argparse.BooleanOptionalAction,
         help='print systemd-measure policy digests for the UKI',
     ),
-    ConfigItem(
-        '--sign-initrd-pcrs',
-        action=argparse.BooleanOptionalAction,
-        help='additionally sign PCR policies that can only be satisfied from the initrd',
-        config_key='UKI/SignInitrdPCRs',
-    ),
     ConfigItem(
         '--json',
         choices=('pretty', 'short', 'off'),