diff --git a/java/google/registry/flows/EppRequestHandler.java b/java/google/registry/flows/EppRequestHandler.java
index fa8b5e021..3ad1831ea 100644
--- a/java/google/registry/flows/EppRequestHandler.java
+++ b/java/google/registry/flows/EppRequestHandler.java
@@ -52,8 +52,8 @@ public class EppRequestHandler {
       EppOutput eppOutput =
           eppController.handleEppCommand(
               sessionMetadata, credentials, eppRequestSource, isDryRun, isSuperuser, inputXmlBytes);
-      response.setPayload(new String(marshalWithLenientRetry(eppOutput), UTF_8));
       response.setContentType(APPLICATION_EPP_XML);
+      response.setPayload(new String(marshalWithLenientRetry(eppOutput), UTF_8));
       // Note that we always return 200 (OK) even if the EppController returns an error response.
       // This is because returning a non-OK HTTP status code will cause the proxy server to
       // silently close the connection without returning any data. The only time we will ever return
diff --git a/javatests/google/registry/testing/FakeResponse.java b/javatests/google/registry/testing/FakeResponse.java
index 775ecb2e5..19d4e5d0f 100644
--- a/javatests/google/registry/testing/FakeResponse.java
+++ b/javatests/google/registry/testing/FakeResponse.java
@@ -60,6 +60,7 @@ public final class FakeResponse implements Response {
 
   @Override
   public void setContentType(MediaType contentType) {
+    checkArgument(payload.isEmpty(), "setContentType must be called before setPayload");
     this.contentType = checkNotNull(contentType);
   }