diff --git a/bin/tests/system/nsec3/tests_nsec3_reconfig.py b/bin/tests/system/nsec3/tests_nsec3_reconfig.py
index 666ba320b4..47cd77ecf2 100644
--- a/bin/tests/system/nsec3/tests_nsec3_reconfig.py
+++ b/bin/tests/system/nsec3/tests_nsec3_reconfig.py
@@ -65,6 +65,13 @@ def bootstrap():
 
 @pytest.fixture(scope="module", autouse=True)
 def after_servers_start(ns3, templates):
+    # First make sure all zones are properly signed. Here we specifically need
+    # to wait until all zones have finished key management before we can
+    # reconfigure the server, because changing the DNSSEC policy relies on
+    # zones having finished applying their initial policy.
+    for zone in ZONES:
+        isctest.kasp.wait_keymgr_done(ns3, zone)
+
     # Ensure rsasha1-to-nsec3-wait.kasp is fully signed prior to reconfig.
     with_rsasha1 = "RSASHA1_SUPPORTED"
     assert with_rsasha1 in os.environ, f"{with_rsasha1} env variable undefined"