Yes, there's a risk, but so far it has worked fine. And in the worst case, the second run of chef-client for the cookbooks help.

Note that this will need to be changed when we merge the HA DNS PR, though, as the admin node will not necessarily be the master for DNS. I think we should look at that in a later PR.