diff --git a/src/contact.rs b/src/contact.rs
index 37860a40a..9981d7d86 100644
--- a/src/contact.rs
+++ b/src/contact.rs
@@ -372,7 +372,11 @@ pub(crate) async fn import_public_key(
         .await?
     {
         let old_public_key = SignedPublicKey::from_slice(&public_key_bytes)?;
-        merged_public_key = merge_openpgp_certificates(public_key.clone(), old_public_key)
+
+        // Order of merge_openpgp_certificates() arguments is important.
+        // Second argument is the new key, it is preferred in case of ties,
+        // i.e. same signature timestamps.
+        merged_public_key = merge_openpgp_certificates(old_public_key, public_key.clone())
             .context("Failed to merge public keys")?;
         &merged_public_key
     } else {
diff --git a/src/pgp.rs b/src/pgp.rs
index 907bd35a0..68ffa3e12 100644
--- a/src/pgp.rs
+++ b/src/pgp.rs
@@ -382,6 +382,8 @@ pub fn symm_encrypt_message(
 /// or even have some packets maliciously dropped
 /// (for example, all encryption subkeys dropped)
 /// or restored from some older version of the certificate.
+///
+/// In case of ties, i.e. same timestamps, data from the new certificate is preferred.
 pub fn merge_openpgp_certificates(
     old_certificate: SignedPublicKey,
     new_certificate: SignedPublicKey,