diff --git a/letsencrypt/plugins/standalone.py b/letsencrypt/plugins/standalone.py
index 8b8612fd1..4319e51f9 100644
--- a/letsencrypt/plugins/standalone.py
+++ b/letsencrypt/plugins/standalone.py
@@ -2,7 +2,6 @@
 import argparse
 import collections
 import logging
-import random
 import socket
 import threading
 
@@ -108,7 +107,7 @@ class ServerManager(object):
                     in six.iteritems(self._instances))
 
 
-SUPPORTED_CHALLENGES = set([challenges.TLSSNI01, challenges.HTTP01])
+SUPPORTED_CHALLENGES = [challenges.TLSSNI01, challenges.HTTP01]
 
 
 def supported_challenges_validator(data):
@@ -166,16 +165,16 @@ class Authenticator(common.Plugin):
 
     @classmethod
     def add_parser_arguments(cls, add):
-        add("supported-challenges", help="Supported challenges, "
-            "order preferences are randomly chosen.",
-            type=supported_challenges_validator, default=",".join(
-                sorted(chall.typ for chall in SUPPORTED_CHALLENGES)))
+        add("supported-challenges",
+            help="Supported challenges. Preferred in the order they are listed.",
+            type=supported_challenges_validator,
+            default=",".join(chall.typ for chall in SUPPORTED_CHALLENGES))
 
     @property
     def supported_challenges(self):
         """Challenges supported by this plugin."""
-        return set(challenges.Challenge.TYPES[name] for name in
-                   self.conf("supported-challenges").split(","))
+        return [challenges.Challenge.TYPES[name] for name in
+                self.conf("supported-challenges").split(",")]
 
     @property
     def _necessary_ports(self):
@@ -198,9 +197,7 @@ class Authenticator(common.Plugin):
 
     def get_chall_pref(self, domain):
         # pylint: disable=unused-argument,missing-docstring
-        chall_pref = list(self.supported_challenges)
-        random.shuffle(chall_pref)  # 50% for each challenge
-        return chall_pref
+        return self.supported_challenges
 
     def perform(self, achalls):  # pylint: disable=missing-docstring
         if any(util.already_listening(port) for port in self._necessary_ports):
diff --git a/letsencrypt/plugins/standalone_test.py b/letsencrypt/plugins/standalone_test.py
index 26a040c2e..1e39dee57 100644
--- a/letsencrypt/plugins/standalone_test.py
+++ b/letsencrypt/plugins/standalone_test.py
@@ -98,17 +98,27 @@ class AuthenticatorTest(unittest.TestCase):
 
     def test_supported_challenges(self):
         self.assertEqual(self.auth.supported_challenges,
-                         set([challenges.TLSSNI01, challenges.HTTP01]))
+                         [challenges.TLSSNI01, challenges.HTTP01])
+
+    def test_supported_challenges_configured(self):
+        self.config.standalone_supported_challenges = "tls-sni-01"
+        self.assertEqual(self.auth.supported_challenges,
+                         [challenges.TLSSNI01])
 
     def test_more_info(self):
         self.assertTrue(isinstance(self.auth.more_info(), six.string_types))
 
     def test_get_chall_pref(self):
-        self.assertEqual(set(self.auth.get_chall_pref(domain=None)),
-                         set([challenges.TLSSNI01, challenges.HTTP01]))
+        self.assertEqual(self.auth.get_chall_pref(domain=None),
+                         [challenges.TLSSNI01, challenges.HTTP01])
+
+    def test_get_chall_pref_configured(self):
+        self.config.standalone_supported_challenges = "tls-sni-01"
+        self.assertEqual(self.auth.get_chall_pref(domain=None),
+                         [challenges.TLSSNI01])
 
     @mock.patch("letsencrypt.plugins.standalone.util")
-    def test_perform_alredy_listening(self, mock_util):
+    def test_perform_already_listening(self, mock_util):
         for chall, port in ((challenges.TLSSNI01.typ, 1234),
                             (challenges.HTTP01.typ, 4321)):
             mock_util.already_listening.return_value = True