diff --git a/bin/dry-run.rb b/bin/dry-run.rb
index 811b5ed908..76075daec3 100755
--- a/bin/dry-run.rb
+++ b/bin/dry-run.rb
@@ -679,6 +679,11 @@ def security_fix?(dependency)
     next
   end
 
+  if checker.up_to_date?
+    puts "    (no update needed as it's already up-to-date)"
+    next
+  end
+
   if checker.vulnerable?
     if checker.lowest_security_fix_version
       puts " => earliest available non-vulnerable version is " \
@@ -695,11 +700,6 @@ def security_fix?(dependency)
                            end
   puts " => latest allowed version is #{latest_allowed_version || dep.version}"
 
-  if checker.up_to_date?
-    puts "    (no update needed as it's already up-to-date)"
-    next
-  end
-
   requirements_to_unlock =
     if $options[:lockfile_only] || !checker.requirements_unlocked_or_can_be?
       if checker.can_update?(requirements_to_unlock: :none) then :none