diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f6a753c..d21a01b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -111,12 +111,6 @@ jobs:
           # next steps don't need Logstash
           docker compose stop logstash
 
-      - name: 'debug: Display state and logs (Enterprise Search)'
-        if: always()
-        run: |
-          docker compose -f docker-compose.yml -f extensions/enterprise-search/enterprise-search-compose.yml ps
-          docker compose -f docker-compose.yml -f extensions/enterprise-search/enterprise-search-compose.yml logs enterprise-search
-
       #
       # Fleet
       #
@@ -205,6 +199,12 @@ jobs:
           sed -i '/xpack.security.authc.api_key.enabled: true/d' elasticsearch/config/elasticsearch.yml
           docker compose restart elasticsearch
 
+      - name: 'debug: Display state and logs (Enterprise Search)'
+        if: always()
+        run: |
+          docker compose -f docker-compose.yml -f extensions/enterprise-search/enterprise-search-compose.yml ps
+          docker compose -f docker-compose.yml -f extensions/enterprise-search/enterprise-search-compose.yml logs enterprise-search
+
         ##############
         #            #
         # Tear down. #