diff --git a/.envrc b/.envrc
index b48409afbc..475d919326 100644
--- a/.envrc
+++ b/.envrc
@@ -14,8 +14,14 @@ use_flake_subdir() {
   fi
 }
 
-# Private .envrc
-[[ -f .envrc.private ]] && [[ -z "$IGNORE_PRIVATE_ENVRC" ]] && source_env .envrc.private || true
+source_envrc_private() {
+  [[ -f .envrc.private ]] && [[ -z "$IGNORE_PRIVATE_ENVRC" ]] && source_env .envrc.private || true
+}
+
+# Source .envrc.private before use_flake_subdir because it provides ARTIFACTORY_PASSWORD
+# which determines whether the enterprise or OSS nix shell is used.
+# This workaround can be removed once the enterprise edition is removed.
+source_envrc_private
 
 # TODO(DACH-NY/canton-network-node#3876) work around for $TMPDIR is removed. #3876 to investigate more
 OLD_TMPDIR=$TMPDIR
@@ -27,6 +33,10 @@ export TMPDIR=$OLD_TMPDIR
 
 source_env .envrc.vars
 
+# Re-source .envrc.private so it can override any vars from .envrc.vars
+source_envrc_private
+
+
 source "${TOOLS_LIB}/libcli.source"
 
 source_env .envrc.validate