diff --git a/daemon/call.c b/daemon/call.c
index 8b99f9c69..f3a61b793 100644
--- a/daemon/call.c
+++ b/daemon/call.c
@@ -1708,6 +1708,17 @@ static void __generate_crypto(const struct sdp_ng_flags *flags, struct call_medi
 		return;
 	}
 
+	if (flags->opmode == OP_OFFER) {
+		/* we always offer actpass */
+		MEDIA_SET(this, SETUP_PASSIVE);
+		MEDIA_SET(this, SETUP_ACTIVE);
+	}
+	else {
+		/* if we can be active, we will, otherwise we'll be passive */
+		if (MEDIA_ISSET(this, SETUP_ACTIVE))
+			MEDIA_CLEAR(this, SETUP_PASSIVE);
+	}
+
 	if (!MEDIA_ISSET(this, INITIALIZED)) {
 		/* we offer both DTLS and SDES by default */
 		MEDIA_SET(this, DTLS);
@@ -1721,17 +1732,6 @@ static void __generate_crypto(const struct sdp_ng_flags *flags, struct call_medi
 		}
 	}
 
-	if (flags->opmode == OP_OFFER) {
-		/* we always offer actpass */
-		MEDIA_SET(this, SETUP_PASSIVE);
-		MEDIA_SET(this, SETUP_ACTIVE);
-	}
-	else {
-		/* if we can be active, we will, otherwise we'll be passive */
-		if (MEDIA_ISSET(this, SETUP_ACTIVE))
-			MEDIA_CLEAR(this, SETUP_PASSIVE);
-	}
-
 	/* for answer case, otherwise we default to one */
 	this->sdes_out.tag = this->sdes_in.params.crypto_suite ? this->sdes_in.tag : 1;