diff --git a/website/source/docs/agent/cloud-auto-join.html.md b/website/source/docs/agent/cloud-auto-join.html.md
index 1c24f5a64..67664c45c 100644
--- a/website/source/docs/agent/cloud-auto-join.html.md
+++ b/website/source/docs/agent/cloud-auto-join.html.md
@@ -146,6 +146,10 @@ $ consul agent -retry-join "provider=gce project_name=... tag_value=..."
 
 #### Authentication & Precedence
 
+Discovery requires a [GCE Service
+Account](https://cloud.google.com/compute/docs/access/service-accounts).
+Credentials are searched using the following paths, in order of precedence.
+
 - Use credentials from `credentials_file`, if provided.
 - Use JSON file from `GOOGLE_APPLICATION_CREDENTIALS` environment variable.
 - Use JSON file in a location known to the gcloud command-line tool.
@@ -154,10 +158,6 @@ $ consul agent -retry-join "provider=gce project_name=... tag_value=..."
 - On Google Compute Engine, use credentials from the metadata
     server. In this final case any provided scopes are ignored.
 
-Discovery requires a [GCE Service
-Account](https://cloud.google.com/compute/docs/access/service-accounts).
-Credentials are searched using the following paths, in order of precedence.
-
 ### IBM SoftLayer
 
 This returns the first private IP address of all servers for the given