diff --git a/CHANGES b/CHANGES
index f5d8da16c3..e17a1a33ce 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3927.	[bug]		dig: report PKCS#11 error codes correctly when
+			compiled with --enable-native-pkcs11. [RT #36956]
+
 3926.	[doc]		Added doc for geoip-directory. [RT #36877]
 
 3925.	[bug]		DS lookup of RFC 1918 empty zones failed. [RT #36917]
diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
index 23dd283940..730f1b57ef 100644
--- a/bin/dig/Makefile.in
+++ b/bin/dig/Makefile.in
@@ -28,7 +28,7 @@ READLINE_LIB = @READLINE_LIB@
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${BIND9_INCLUDES} \
 		${ISC_INCLUDES} ${LWRES_INCLUDES} ${ISCCFG_INCLUDES}
 
-CDEFINES =	-DVERSION=\"${VERSION}\"
+CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@
 CWARNINGS =
 
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 1a0202b9d6..d3f92c0824 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -98,6 +98,10 @@
 
 #include <dig/dig.h>
 
+#ifdef PKCS11CRYPTO
+#include <pk11/result.h>
+#endif
+
 #if ! defined(NS_INADDRSZ)
 #define NS_INADDRSZ	 4
 #endif
@@ -1434,6 +1438,11 @@ setup_libs(void) {
 
 	debug("setup_libs()");
 
+#ifdef PKCS11CRYPTO
+	pk11_result_register();
+#endif
+	dns_result_register();
+
 	result = isc_net_probeipv4();
 	if (result == ISC_R_SUCCESS)
 		have_ipv4 = ISC_TRUE;
@@ -1492,8 +1501,6 @@ setup_libs(void) {
 
 	result = isc_mutex_init(&lookup_lock);
 	check_result(result, "isc_mutex_init");
-
-	dns_result_register();
 }
 
 #define EDNSOPTS 100U