diff --git a/.changelog/12793.txt b/.changelog/12793.txt
new file mode 100644
index 000000000..e9affecc6
--- /dev/null
+++ b/.changelog/12793.txt
@@ -0,0 +1,5 @@
+```release-note:bug
+The Connect CA Vault system now sets the Namespace (if present) prior
+to attempting to login to Vault. This means the AuthMethod needs to
+be in the specified namespace. Previously the AuthMethod needed to be
+in the root namespace to work.
diff --git a/agent/connect/ca/provider_vault.go b/agent/connect/ca/provider_vault.go
index 787e5a247..dd548b218 100644
--- a/agent/connect/ca/provider_vault.go
+++ b/agent/connect/ca/provider_vault.go
@@ -103,6 +103,14 @@ func (v *VaultProvider) Configure(cfg ProviderConfig) error {
 		return err
 	}
 
+	// We don't want to set the namespace if it's empty to prevent potential
+	// unknown behavior (what does Vault do with an empty namespace). The Vault
+	// client also makes sure the inputs are not empty strings so let's do the
+	// same.
+	if config.Namespace != "" {
+		client.SetNamespace(config.Namespace)
+	}
+
 	if config.AuthMethod != nil {
 		loginResp, err := vaultLogin(client, config.AuthMethod)
 		if err != nil {
@@ -112,13 +120,6 @@ func (v *VaultProvider) Configure(cfg ProviderConfig) error {
 	}
 	client.SetToken(config.Token)
 
-	// We don't want to set the namespace if it's empty to prevent potential
-	// unknown behavior (what does Vault do with an empty namespace). The Vault
-	// client also makes sure the inputs are not empty strings so let's do the
-	// same.
-	if config.Namespace != "" {
-		client.SetNamespace(config.Namespace)
-	}
 	v.config = config
 	v.client = client
 	v.isPrimary = cfg.IsPrimary