diff --git a/galaxy_ng/app/dynaconf_hooks.py b/galaxy_ng/app/dynaconf_hooks.py
index ecf906a609..c560772f4b 100755
--- a/galaxy_ng/app/dynaconf_hooks.py
+++ b/galaxy_ng/app/dynaconf_hooks.py
@@ -551,7 +551,7 @@ def configure_authentication_backends(settings: Dynaconf) -> Dict[str, Any]:
     based on the value of AUTHENTICATION_BACKEND_PRESET the installer should set.
 
     For AAP user migration scenarios (https://github.com/ansible/django-ansible-base/pull/611),
-    the PrefixedUserAuthBackend must always be first in the list.
+    the PrefixedUserAuthBackend should always be last in the list.
     """
 
     data = {}
@@ -559,11 +559,6 @@ def configure_authentication_backends(settings: Dynaconf) -> Dict[str, Any]:
     # default data
     backends = settings.get("AUTHENTICATION_BACKENDS", [])
 
-    # insert prefix stuff
-    prefix_backend = "ansible_base.lib.backends.prefixed_user_auth.PrefixedUserAuthBackend"
-    if prefix_backend not in backends:
-        backends.insert(0, prefix_backend)
-
     # Load preset data
     preset_name = settings.get("AUTHENTICATION_BACKEND_PRESET")
     if (preset_list := settings.AUTHENTICATION_BACKEND_PRESETS_DATA.get(preset_name)) is not None:
@@ -571,6 +566,11 @@ def configure_authentication_backends(settings: Dynaconf) -> Dict[str, Any]:
             if item not in backends:
                 backends.append(item)
 
+    # insert prefix stuff
+    prefix_backend = "ansible_base.lib.backends.prefixed_user_auth.PrefixedUserAuthBackend"
+    if prefix_backend not in backends:
+        backend.append(prefix_backend)
+
     # deduplicate dynaconf_merge ...
     if backends.count('dynaconf_merge'):
         backends = [x for x in backends if x != 'dynconf_merge']