(PUP-3258) fix ENC issue with puppet apply

Rebased on stable, replaces #3118.
Yeah. I actually verified this approach by locating your most recent change to `ldap` :-)