diff --git a/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationInitializer.java b/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationInitializer.java
index f6ae3e8a..4930d25b 100644
--- a/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationInitializer.java
+++ b/spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationInitializer.java
@@ -15,8 +15,10 @@
  */
 package org.springframework.cloud.bootstrap.encrypt;
 
+import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
@@ -154,7 +156,11 @@ public class EnvironmentDecryptApplicationInitializer implements
 
 	public Map<String, Object> decrypt(PropertySources propertySources) {
 		Map<String, Object> overrides = new LinkedHashMap<String, Object>();
+		List<PropertySource<?>> sources = new ArrayList<PropertySource<?>>();
 		for (PropertySource<?> source : propertySources) {
+			sources.add(0, source);
+		}
+		for (PropertySource<?> source : sources) {
 			decrypt(source, overrides);
 		}
 		return overrides;
diff --git a/spring-cloud-context/src/test/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListenerTests.java b/spring-cloud-context/src/test/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListenerTests.java
index d9fb86ab..4e6ef446 100644
--- a/spring-cloud-context/src/test/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListenerTests.java
+++ b/spring-cloud-context/src/test/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListenerTests.java
@@ -15,46 +15,63 @@
  */
 package org.springframework.cloud.bootstrap.encrypt;
 
-import static org.junit.Assert.assertEquals;
+import java.util.Collections;
 
 import org.junit.Test;
 import org.springframework.boot.test.EnvironmentTestUtils;
 import org.springframework.context.ConfigurableApplicationContext;
 import org.springframework.context.annotation.AnnotationConfigApplicationContext;
+import org.springframework.core.env.MapPropertySource;
 import org.springframework.security.crypto.encrypt.Encryptors;
 
+import static org.junit.Assert.assertEquals;
+
 /**
  * @author Dave Syer
  *
  */
 public class EnvironmentDecryptApplicationListenerTests {
-	
-	private EnvironmentDecryptApplicationInitializer listener = new EnvironmentDecryptApplicationInitializer(Encryptors.noOpText());
+
+	private EnvironmentDecryptApplicationInitializer listener = new EnvironmentDecryptApplicationInitializer(
+			Encryptors.noOpText());
 
 	@Test
 	public void decryptCipherKey() {
 		ConfigurableApplicationContext context = new AnnotationConfigApplicationContext();
 		EnvironmentTestUtils.addEnvironment(context, "foo: {cipher}bar");
-		listener.initialize(context);
+		this.listener.initialize(context);
 		assertEquals("bar", context.getEnvironment().getProperty("foo"));
 	}
 
-	@Test(expected=IllegalStateException.class)
-	public void errorOnDecrypt() {
-		listener = new EnvironmentDecryptApplicationInitializer(Encryptors.text("deadbeef", "AFFE37"));
+	@Test
+	public void propertySourcesOrderedCorrectly() {
 		ConfigurableApplicationContext context = new AnnotationConfigApplicationContext();
 		EnvironmentTestUtils.addEnvironment(context, "foo: {cipher}bar");
-		listener.initialize(context);
+		context.getEnvironment().getPropertySources().addFirst(new MapPropertySource(
+				"test_override",
+				Collections.<String, Object> singletonMap("foo", "{cipher}spam")));
+		this.listener.initialize(context);
+		assertEquals("spam", context.getEnvironment().getProperty("foo"));
+	}
+
+	@Test(expected = IllegalStateException.class)
+	public void errorOnDecrypt() {
+		this.listener = new EnvironmentDecryptApplicationInitializer(
+				Encryptors.text("deadbeef", "AFFE37"));
+		ConfigurableApplicationContext context = new AnnotationConfigApplicationContext();
+		EnvironmentTestUtils.addEnvironment(context, "foo: {cipher}bar");
+		this.listener.initialize(context);
 		assertEquals("bar", context.getEnvironment().getProperty("foo"));
 	}
 
 	@Test
 	public void errorOnDecryptWithEmpty() {
-		listener = new EnvironmentDecryptApplicationInitializer(Encryptors.text("deadbeef", "AFFE37"));
-		listener.setFailOnError(false);
+		this.listener = new EnvironmentDecryptApplicationInitializer(
+				Encryptors.text("deadbeef", "AFFE37"));
+		this.listener.setFailOnError(false);
 		ConfigurableApplicationContext context = new AnnotationConfigApplicationContext();
 		EnvironmentTestUtils.addEnvironment(context, "foo: {cipher}bar");
-		listener.initialize(context);
+		this.listener.initialize(context);
 		// Empty is safest fallback for undecryptable cipher
 		assertEquals("", context.getEnvironment().getProperty("foo"));
 	}