diff --git a/src/confluent_kafka/schema_registry/rules/encryption/encrypt_executor.py b/src/confluent_kafka/schema_registry/rules/encryption/encrypt_executor.py
index 08b04ef50..01838364a 100644
--- a/src/confluent_kafka/schema_registry/rules/encryption/encrypt_executor.py
+++ b/src/confluent_kafka/schema_registry/rules/encryption/encrypt_executor.py
@@ -68,8 +68,8 @@ def configure(self, client_conf: dict, rule_conf: dict):
             else:
                 self.client = DekRegistryClient.new_client(client_conf)
 
-        if rule_conf:
-            if self.config:
+        if self.config:
+            if rule_conf:
                 for key, value in rule_conf.items():
                     v = self.config.get(key)
                     if v is not None:
@@ -77,8 +77,8 @@ def configure(self, client_conf: dict, rule_conf: dict):
                             raise RuleError(f"rule config key already set: {key}")
                     else:
                         self.config[key] = value
-            else:
-                self.config = rule_conf
+        else:
+            self.config = rule_conf if rule_conf else {}
 
     def type(self) -> str:
         return "ENCRYPT"