diff --git a/src/knot/server/zones.c b/src/knot/server/zones.c
index 074811b9aab98e67bb5373491eea05fcb26f8877..abb3ac953626a408926ed6059fda967e505286db 100644
--- a/src/knot/server/zones.c
+++ b/src/knot/server/zones.c
@@ -2017,6 +2017,21 @@ static int zones_process_update_auth(knot_zone_t *zone,
 
 	dbg_zload_verb("%s: DNSSEC changes applied\n", msg);
 
+	// Commit transaction.
+	if (transaction) {
+		ret = zones_store_changesets_commit(transaction);
+		if (ret != KNOT_EOK) {
+			log_zone_error("%s: Failed to commit stored "
+			               "changesets: %s."
+			               "\n", msg, knot_strerror(ret));
+			xfrin_rollback_update(zone->contents, &new_contents,
+			                      chgsets->changes);
+			zones_free_merged_changesets(chgsets, sec_chs);
+			free(msg);
+			return ret;
+		}
+	}
+
 	// Switch zone contents.
 	knot_zone_retain(zone); /* Retain pointer for safe RCU unlock. */
 	rcu_read_unlock();      /* Unlock for switch. */
@@ -2037,21 +2052,6 @@ static int zones_process_update_auth(knot_zone_t *zone,
 		return KNOT_ERROR;
 	}
 
-	// Commit transaction.
-	if (transaction) {
-		ret = zones_store_changesets_commit(transaction);
-		if (ret != KNOT_EOK) {
-			log_zone_error("%s: Failed to commit stored "
-			               "changesets: %s."
-			               "\n", msg, knot_strerror(ret));
-			xfrin_rollback_update(zone->contents, &new_contents,
-			                      chgsets->changes);
-			zones_free_merged_changesets(chgsets, sec_chs);
-			free(msg);
-			return ret;
-		}
-	}
-
 	// Cleanup.
 	xfrin_cleanup_successful_update(chgsets->changes);
 	if (sec_chs) {