diff --git a/pkg/clientauth/roundtripper.go b/pkg/clientauth/roundtripper.go
index 225f6afcad9..61d79ceb7f4 100644
--- a/pkg/clientauth/roundtripper.go
+++ b/pkg/clientauth/roundtripper.go
@@ -73,8 +73,8 @@ func NewStaticTokenExchangeTransportWrapper(
 // NewTokenExchangeTransportWrapperWithStrategies creates a transport.WrapperFunc with custom strategies.
 func NewTokenExchangeTransportWrapper(
 	exchanger authnlib.TokenExchanger,
-	namespaceProvider NamespaceProvider,
 	audienceProvider AudienceProvider,
+	namespaceProvider NamespaceProvider,
 ) transport.WrapperFunc {
 	return func(rt http.RoundTripper) http.RoundTripper {
 		return newTokenExchangeRoundTripperWithStrategies(
diff --git a/pkg/operators/provisioning/config.go b/pkg/operators/provisioning/config.go
index 41bccd7d004..4027acd025a 100644
--- a/pkg/operators/provisioning/config.go
+++ b/pkg/operators/provisioning/config.go
@@ -175,8 +175,8 @@ func setupFromConfig(cfg *setting.Cfg, registry prometheus.Registerer) (controll
 			Host:    url,
 			WrapTransport: clientauth.NewTokenExchangeTransportWrapper(
 				tokenExchangeClient,
-				clientauth.NewStaticNamespaceProvider(clientauth.WildcardNamespace),
 				clientauth.NewStaticAudienceProvider(audiences...),
+				clientauth.NewStaticNamespaceProvider(clientauth.WildcardNamespace),
 			),
 			Transport: &http.Transport{
 				MaxConnsPerHost:     100,