diff --git a/src/lib/server/tmpl_tokenize.c b/src/lib/server/tmpl_tokenize.c
index b75726cda850..b17a0a79ab6c 100644
--- a/src/lib/server/tmpl_tokenize.c
+++ b/src/lib/server/tmpl_tokenize.c
@@ -2878,20 +2878,6 @@ fr_slen_t tmpl_afrom_substr(TALLOC_CTX *ctx, tmpl_t **out,
 		if (fr_sbuff_is_char(&our_in, '&')) return tmpl_afrom_attr_substr(ctx, NULL, out, in,
 										  p_rules, t_rules);
 
-		/*
-		 *	::value
-		 *
-		 *	Treated as enum name.
-		 *
-		 *	@todo - move the enum parsing here, and then unresolved tmpls _always_ become xlat references.
-		 *	and when we fix that, change the enum name to include the ::
-		 */
-		if (fr_sbuff_is_str_literal(&our_in, "::")) {
-			(void) fr_sbuff_advance(&our_in, 2);
-			goto do_enum;
-		}
-
-
 		/*
 		 *	Allow bareword xlats if we
 		 *	find a '%' prefix.
@@ -2973,6 +2959,20 @@ fr_slen_t tmpl_afrom_substr(TALLOC_CTX *ctx, tmpl_t **out,
 		if (slen > 0) goto done_bareword;
 		fr_assert(!*out);
 
+		/*
+		 *	::value
+		 *
+		 *	Treated as enum name.  Note that this check MUST be done after the test for IPv6, as
+		 *	"::1" is an allowed IPv6 address.
+		 *
+		 *	@todo - move the enum parsing here, and then unresolved tmpls _always_ become xlat references.
+		 *	and when we fix that, change the enum name to include the ::
+		 */
+		if (fr_sbuff_is_str_literal(&our_in, "::")) {
+			(void) fr_sbuff_advance(&our_in, 2);
+			goto do_enum;
+		}
+
 		/*
 		 *	See if it's a integer
 		 */