diff --git a/CHANGES b/CHANGES
index dad4e32413..2a72463b1d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6326.	[func]		Add workaround to enforce dynamic linker to pull
+			jemalloc earlier than libc to ensure all memory
+			allocations are done via jemalloc. [GL #4404]
+
 6325.	[func]		Expose the TCP client count in statistics channel.
 			[GL #4425]
 
diff --git a/Makefile.tests b/Makefile.tests
index e1b7e0e046..a0ea914d40 100644
--- a/Makefile.tests
+++ b/Makefile.tests
@@ -21,3 +21,8 @@ AM_CPPFLAGS +=					\
 LDADD +=						\
 	$(top_builddir)/tests/libtest/libtest.la	\
 	$(CMOCKA_LIBS)
+
+if HAVE_JEMALLOC
+AM_CFLAGS += $(JEMALLOC_CFLAGS)
+LDADD += $(JEMALLOC_LIBS)
+endif
diff --git a/Makefile.top b/Makefile.top
index d01317dadb..da95a2d47a 100644
--- a/Makefile.top
+++ b/Makefile.top
@@ -23,12 +23,20 @@ AM_LDFLAGS +=					\
 	-Wl,-flat_namespace
 endif HOST_MACOS
 
-LIBISC_CFLAGS =						\
+if HAVE_JEMALLOC
+LIBISC_CFLAGS = $(JEMALLOC_CFLAGS)
+LIBISC_LIBS = $(JEMALLOC_LIBS)
+else
+LIBISC_CFLAGS =
+LIBISC_LIBS =
+endif
+
+LIBISC_CFLAGS +=						\
 	-I$(top_srcdir)/include				\
 	-I$(top_srcdir)/lib/isc/include			\
 	-I$(top_builddir)/lib/isc/include
 
-LIBISC_LIBS = $(top_builddir)/lib/isc/libisc.la
+LIBISC_LIBS += $(top_builddir)/lib/isc/libisc.la
 if HAVE_DTRACE
 LIBISC_DTRACE = $(top_builddir)/lib/isc/probes.lo
 endif
diff --git a/lib/isc/include/isc/mem.h b/lib/isc/include/isc/mem.h
index 6c099d8742..2ee8c9e200 100644
--- a/lib/isc/include/isc/mem.h
+++ b/lib/isc/include/isc/mem.h
@@ -23,6 +23,7 @@
 #include <isc/mutex.h>
 #include <isc/overflow.h>
 #include <isc/types.h>
+#include <isc/urcu.h>
 
 ISC_LANG_BEGINDECLS
 
@@ -183,7 +184,31 @@ extern unsigned int isc_mem_defaultflags;
 	} while (0)
 
 /*@{*/
+/*
+ * This is a little hack to help with dynamic link order,
+ * see https://github.com/jemalloc/jemalloc/issues/2566
+ * for more information.
+ */
+#if HAVE_JEMALLOC
+
+/*
+ * cmocka.h has confliction definitions with the jemalloc header but we only
+ * need the mallocx symbol from jemalloc.
+ */
+void *
+mallocx(size_t size, int flags);
+
+extern volatile void *isc__mem_malloc;
+
+#define isc_mem_create(cp)                                            \
+	{                                                             \
+		isc__mem_create((cp)_ISC_MEM_FILELINE);               \
+		isc__mem_malloc = mallocx;                            \
+		ISC_INSIST(CMM_ACCESS_ONCE(isc__mem_malloc) != NULL); \
+	}
+#else
 #define isc_mem_create(cp) isc__mem_create((cp)_ISC_MEM_FILELINE)
+#endif
 void
 isc__mem_create(isc_mem_t **_ISC_MEM_FLARG);
 
diff --git a/lib/isc/mem.c b/lib/isc/mem.c
index e43ae4fc03..c23a39075e 100644
--- a/lib/isc/mem.c
+++ b/lib/isc/mem.c
@@ -69,6 +69,8 @@ unsigned int isc_mem_defaultflags = ISC_MEMFLAG_DEFAULT;
 
 #define ISC_MEM_ILLEGAL_ARENA (UINT_MAX)
 
+volatile void *isc__mem_malloc = mallocx;
+
 /*
  * Constants.
  */
diff --git a/tests/libtest/dns.c b/tests/libtest/dns.c
index 73fb630807..29ac69e5fa 100644
--- a/tests/libtest/dns.c
+++ b/tests/libtest/dns.c
@@ -24,9 +24,6 @@
 #include <time.h>
 #include <unistd.h>
 
-#define UNIT_TESTING
-#include <cmocka.h>
-
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/hash.h>
@@ -264,7 +261,7 @@ dns_test_tohex(const unsigned char *data, size_t len, char *buf,
 	memset(buf, 0, buflen);
 	isc_buffer_init(&target, buf, buflen);
 	result = isc_hex_totext((isc_region_t *)&source, 1, " ", &target);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	INSIST(result == ISC_R_SUCCESS);
 
 	return (buf);
 }
@@ -428,7 +425,7 @@ dns_test_namefromstring(const char *namestr, dns_fixedname_t *fname) {
 
 	isc_buffer_putmem(b, (const unsigned char *)namestr, length);
 	result = dns_name_fromtext(name, b, NULL, 0, NULL);
-	assert_int_equal(result, ISC_R_SUCCESS);
+	INSIST(result == ISC_R_SUCCESS);
 
 	isc_buffer_free(&b);
 }