Our order is simple. We pull back the insulation over each leak, seal around the ceiling lights, ducts, pipes, wiring and flues, and then push the old insulation back into place if it's still usable. Narrow gaps get caulk, foam or an aerosol sealant on their own, and bigger openings get a rigid piece of blocking cut to fit and sealed in place.
The flue gets extra care because it runs hot. Gaps around it get fire-rated caulk and a rated metal collar or sheet metal, and we keep safe clearance between the flue and anything that can burn. We also watch the hatch, the eave vents and the thin edges along the walls, since a missed gap or a buried vent is where most attic jobs go wrong.
When the old insulation is wet, full of droppings or too thin to do much, sealing still comes first, and retrofit insulation is how we add more to a house that's already built. Some attics are better off with spray foam insulation, which starts from the same sealing plan. The choice usually comes down to these two.