diff --git a/src/args.rs b/src/args.rs
index ff40825..c655d2f 100644
--- a/src/args.rs
+++ b/src/args.rs
@@ -6,6 +6,7 @@ use std::path::{Path, PathBuf};
 use crate::systemd::service_exists;
 
 pub const SUPERVISOR_SERVICE: &str = "balena-supervisor.service";
+pub const EXTRACT_BALENA_CA_SERVICE: &str = "extract-balena-ca.service";
 
 const CONFIG_ROUTE: &str = "/os/v1/config";
 const OS_CONFIG_PATH: &str = "/etc/os-config.json";
diff --git a/src/join.rs b/src/join.rs
index 7e23f55..c09f968 100644
--- a/src/join.rs
+++ b/src/join.rs
@@ -1,7 +1,7 @@
 use crate::fs;
 use std::path::Path;
 
-use crate::args::{Args, SUPERVISOR_SERVICE};
+use crate::args::{Args, EXTRACT_BALENA_CA_SERVICE, SUPERVISOR_SERVICE};
 use crate::config_json::{
     get_api_endpoint, get_root_certificate, merge_config_json, read_config_json, write_config_json,
     ConfigMap,
@@ -93,6 +93,9 @@ fn reconfigure_core(
 ) -> Result<()> {
     if should_write_config_json {
         write_config_json(&args.config_json_path, config_json)?;
+
+        // wait for extract-balena-ca service to finish restarting
+        systemd::start_service(EXTRACT_BALENA_CA_SERVICE)?;
     }
 
     if has_service_config_changes {