diff --git a/net/mosquitto/files/etc/init.d/mosquitto b/net/mosquitto/files/etc/init.d/mosquitto
index de2d02f80..002042a3c 100755
--- a/net/mosquitto/files/etc/init.d/mosquitto
+++ b/net/mosquitto/files/etc/init.d/mosquitto
@@ -64,6 +64,8 @@ convert_mosq_general() {
 	fi
 
 	append_if "$1" port
+	# per listener settings must be set before any potential security settings
+	append_optional_bool "$1" per_listener_settings
 	append_if "$1" acl_file
 	append_optional_bool "$1" allow_anonymous
 	append_optional_bool "$1" allow_duplicate_messages
@@ -91,9 +93,9 @@ convert_mosq_general() {
 	append_if "$1" sys_interval
 	append_optional_bool "$1" upgrade_outgoing_qos
 	append_if "$1" user
-	append_optional_bool "$1" per_listener_settings
 	append_if "$1" websockets_log_level
 	append_if "$1" websockets_headers_size
+	# can be general or per listener, see per_listener_settings
 	append_if "$1" auth_plugin
 	# Careful, this relies on internal behaviour of the cfg_load functions!
 	set | grep "CONFIG_$1_auth_opt_" | sed "s/^.*_\(auth_opt_.*\)='\(.*\)'/\1 \2/" >> $TCONF
@@ -157,6 +159,10 @@ add_listener() {
     append_optional_bool "$1" use_identity_as_username
     append_optional_bool "$1" use_subject_as_username
     append_if "$1" psk_hint
+    # can be general or per listener, see per_listener_settings
+    append_if "$1" auth_plugin
+    # Careful, this relies on internal behaviour of the cfg_load functions!
+    set | grep "CONFIG_$1_auth_opt_" | sed "s/^.*_\(auth_opt_.*\)='\(.*\)'/\1 \2/" >> $TCONF
 }
 
 add_topic() {