diff --git a/mellon/templates/mellon/metadata.xml b/mellon/templates/mellon/metadata.xml
index 62368e9..da01a4f 100644
--- a/mellon/templates/mellon/metadata.xml
+++ b/mellon/templates/mellon/metadata.xml
@@ -6,6 +6,12 @@
    AuthnRequestsSigned="true"
    WantAssertionsSigned="true"
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <Extensions>
+      <idpdisc:DiscoveryResponse index="1"
+        xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
+        Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
+        Location="{{ discovery_endpoint_url }}"/>
+   </Extensions>
      {% for public_key in public_keys %}
        <KeyDescriptor>
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
@@ -15,12 +21,6 @@
            </ds:KeyInfo>
        </KeyDescriptor>
     {% endfor %}
-    <Extensions>
-      <idpdisc:DiscoveryResponse index="1"
-        xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
-        Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
-        Location="{{ discovery_endpoint_url }}"/>
-   </Extensions>
    <SingleLogoutService
      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
      Location="{{ logout_url }}" />