diff --git a/agent/agent_endpoint.go b/agent/agent_endpoint.go
index c99e3ef14..96c312a2a 100644
--- a/agent/agent_endpoint.go
+++ b/agent/agent_endpoint.go
@@ -35,14 +35,6 @@ func (s *HTTPServer) AgentSelf(resp http.ResponseWriter, req *http.Request) (int
 		return nil, MethodNotAllowedError{req.Method, []string{"GET"}}
 	}
 
-	var cs lib.CoordinateSet
-	if !s.agent.config.DisableCoordinates {
-		var err error
-		if cs, err = s.agent.GetLANCoordinate(); err != nil {
-			return nil, err
-		}
-	}
-
 	// Fetch the ACL token, if any, and enforce agent policy.
 	var token string
 	s.parseToken(req, &token)
@@ -54,6 +46,14 @@ func (s *HTTPServer) AgentSelf(resp http.ResponseWriter, req *http.Request) (int
 		return nil, acl.ErrPermissionDenied
 	}
 
+	var cs lib.CoordinateSet
+	if !s.agent.config.DisableCoordinates {
+		var err error
+		if cs, err = s.agent.GetLANCoordinate(); err != nil {
+			return nil, err
+		}
+	}
+
 	config := struct {
 		Datacenter string
 		NodeName   string