diff --git a/lib/ansible/cli/vault.py b/lib/ansible/cli/vault.py
index d28abacd5a..bae7377750 100644
--- a/lib/ansible/cli/vault.py
+++ b/lib/ansible/cli/vault.py
@@ -128,6 +128,6 @@ class VaultCLI(CLI):
             __, new_password = self.ask_vault_passwords(ask_vault_pass=False, ask_new_vault_pass=True, confirm_new=True)
 
         for f in self.args:
-            self.editor.rekey_file(new_password, f)
+            self.editor.rekey_file(f, new_password)
 
         self.display.display("Rekey successful", stderr=True)
diff --git a/lib/ansible/parsing/vault/__init__.py b/lib/ansible/parsing/vault/__init__.py
index c9f2c4a4f6..c9d4372e7b 100644
--- a/lib/ansible/parsing/vault/__init__.py
+++ b/lib/ansible/parsing/vault/__init__.py
@@ -336,7 +336,7 @@ class VaultEditor:
         else:
             raise AnsibleError("%s is already encrypted" % filename)
 
-    def rekey_file(self, new_password, filename):
+    def rekey_file(self, filename, new_password):
 
         check_prereqs()
 
diff --git a/test/units/parsing/vault/test_vault_editor.py b/test/units/parsing/vault/test_vault_editor.py
index d1fa0d07a0..e943b00868 100644
--- a/test/units/parsing/vault/test_vault_editor.py
+++ b/test/units/parsing/vault/test_vault_editor.py
@@ -185,7 +185,7 @@ class TestVaultEditor(unittest.TestCase):
         # make sure the password functions for the cipher
         error_hit = False
         try:
-            ve.rekey_file('ansible2', v10_file.name)
+            ve.rekey_file(v10_file.name, 'ansible2')
         except errors.AnsibleError as e:
             error_hit = True