diff --git a/client.go b/client.go
index 6a976798..6a11e93d 100644
--- a/client.go
+++ b/client.go
@@ -368,7 +368,6 @@ func (c *Client) sendAllocateRequest(protocol proto.Protocol) ( //nolint:cyclop
 		stun.TransactionID,
 		stun.NewType(stun.MethodAllocate, stun.ClassRequest),
 		proto.RequestedTransport{Protocol: protocol},
-		stun.Fingerprint,
 	}
 
 	allocationSetters = appendRequestedAddressFamilyOrReservation(
@@ -378,6 +377,9 @@ func (c *Client) sendAllocateRequest(protocol proto.Protocol) ( //nolint:cyclop
 		allocationSetters = append(allocationSetters, proto.EvenPort{ReservePort: true})
 	}
 
+	// FINGERPRINT must be the last attribute per RFC 5389
+	allocationSetters = append(allocationSetters, stun.Fingerprint)
+
 	msg, err := stun.Build(allocationSetters...)
 	if err != nil {
 		return relayed, lifetime, nonce, reservationToken, err
@@ -410,7 +412,6 @@ func (c *Client) sendAllocateRequest(protocol proto.Protocol) ( //nolint:cyclop
 		&c.realm,
 		&nonce,
 		&c.integrity,
-		stun.Fingerprint,
 	}
 
 	allocationSetters = appendRequestedAddressFamilyOrReservation(
@@ -420,6 +421,9 @@ func (c *Client) sendAllocateRequest(protocol proto.Protocol) ( //nolint:cyclop
 		allocationSetters = append(allocationSetters, proto.EvenPort{ReservePort: true})
 	}
 
+	// FINGERPRINT must be the last attribute per RFC 5389
+	allocationSetters = append(allocationSetters, stun.Fingerprint)
+
 	msg, err = stun.Build(allocationSetters...)
 	if err != nil {
 		return relayed, lifetime, nonce, reservationToken, err