diff --git a/src/ssh_guard.py b/src/ssh_guard.py
index 1d3a07e..38d9941 100644
--- a/src/ssh_guard.py
+++ b/src/ssh_guard.py
@@ -14,8 +14,9 @@
 from pathlib import Path
 
 
+# sshd keeps the first value it reads, so the drop-in must sort before others such as 50-cloud-init.conf.
 DEFAULT_CONFIG = Path("C:/ProgramData/ssh/sshd_config") if os.name == "nt" else Path("/etc/ssh/sshd_config")
-DEFAULT_DROPIN = Path("C:/ProgramData/ssh/sshd_config.d/99-dispersal-wolves.conf") if os.name == "nt" else Path("/etc/ssh/sshd_config.d/99-dispersal-wolves.conf")
+DEFAULT_DROPIN = Path("C:/ProgramData/ssh/sshd_config.d/00-dispersal-wolves.conf") if os.name == "nt" else Path("/etc/ssh/sshd_config.d/00-dispersal-wolves.conf")
 
 POLICY = {
     "permitrootlogin": ("no", "Root login should be disabled."),
diff --git a/tests/test_ssh_guard.py b/tests/test_ssh_guard.py
index 9ab59e4..ed86afd 100644
--- a/tests/test_ssh_guard.py
+++ b/tests/test_ssh_guard.py
@@ -2,7 +2,7 @@
 import unittest
 from pathlib import Path
 
-from ssh_guard import audit, install_dropin, parse_config, parse_effective_output
+from ssh_guard import DEFAULT_DROPIN, HARDENED_DROPIN, audit, install_dropin, parse_config, parse_effective_output
 
 
 class SshGuardTests(unittest.TestCase):
@@ -18,6 +18,16 @@ def test_effective_output_and_audit(self):
         self.assertEqual(findings["permitrootlogin"].status, "pass")
         self.assertEqual(findings["maxauthtries"].status, "pass")
 
+    def test_default_dropin_overrides_earlier_dropins(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / "sshd_config.d").mkdir()
+            (root / "sshd_config.d" / "50-cloud-init.conf").write_text("PasswordAuthentication yes\n", encoding="utf-8")
+            (root / "sshd_config.d" / DEFAULT_DROPIN.name).write_text(HARDENED_DROPIN, encoding="utf-8")
+            config = root / "sshd_config"
+            config.write_text("Include sshd_config.d/*.conf\n", encoding="utf-8")
+            self.assertEqual(parse_config(config)["passwordauthentication"], "no")
+
     def test_apply_requires_confirmation(self):
         with tempfile.TemporaryDirectory() as directory:
             ok, message = install_dropin(Path(directory) / "sshd_config", Path(directory) / "dropin", False)