diff --git a/cluster/juju/layers/kubeapi-load-balancer/reactive/load_balancer.py b/cluster/juju/layers/kubeapi-load-balancer/reactive/load_balancer.py
index 0e6d1cdabae..a1576bb4aba 100644
--- a/cluster/juju/layers/kubeapi-load-balancer/reactive/load_balancer.py
+++ b/cluster/juju/layers/kubeapi-load-balancer/reactive/load_balancer.py
@@ -93,12 +93,13 @@ def request_server_certificates(tls, website):
     tls.request_server_cert(common_name, sans, certificate_name)
 
 
-@when('config.changed.extra_sans', 'certificates.available')
-def update_certificate(tls):
+@when('config.changed.extra_sans', 'certificates.available',
+      'website.available')
+def update_certificate(tls, website):
     # Using the config.changed.extra_sans flag to catch changes.
     # IP changes will take ~5 minutes or so to propagate, but
     # it will update.
-    request_server_certificates(tls)
+    request_server_certificates(tls, website)
 
 
 @when('certificates.server.cert.available',
diff --git a/cluster/juju/layers/kubernetes-master/reactive/kubernetes_master.py b/cluster/juju/layers/kubernetes-master/reactive/kubernetes_master.py
index e02a30025f9..df1bd54dd8c 100644
--- a/cluster/juju/layers/kubernetes-master/reactive/kubernetes_master.py
+++ b/cluster/juju/layers/kubernetes-master/reactive/kubernetes_master.py
@@ -609,12 +609,13 @@ def send_data(tls, kube_api_endpoint):
     tls.request_server_cert(common_name, sans, certificate_name)
 
 
-@when('config.changed.extra_sans', 'certificates.available')
-def update_certificate(tls):
+@when('config.changed.extra_sans', 'certificates.available',
+      'kube-api-endpoint.available')
+def update_certificate(tls, kube_api_endpoint):
     # Using the config.changed.extra_sans flag to catch changes.
     # IP changes will take ~5 minutes or so to propagate, but
     # it will update.
-    send_data(tls)
+    send_data(tls, kube_api_endpoint)
 
 
 @when('certificates.server.cert.available',