diff --git a/CHANGES b/CHANGES
index 245fc01037..0bc389858b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3096.	[bug]		Set KRB5_KTNAME before calling log_cred() in
+			dst_gssapi_acceptctx(). [RT #24004]
+
 3095.	[bug]		Handle isolated reserved ports in the port range.
 			[RT #23957]
 
diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index 0c757ff7d6..cf8fba03e7 100644
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: gssapictx.c,v 1.27 2011/03/28 05:20:08 marka Exp $ */
+/* $Id: gssapictx.c,v 1.28 2011/04/07 23:03:22 marka Exp $ */
 
 #include <config.h>
 
@@ -650,8 +650,6 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
 
 	REQUIRE(outtoken != NULL && *outtoken == NULL);
 
-	log_cred(cred);
-
 	REGION_TO_GBUFFER(*intoken, gintoken);
 
 	if (*ctxout == NULL)
@@ -687,6 +685,8 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
 #endif
 	}
 
+	log_cred(cred);
+
 	gret = gss_accept_sec_context(&minor, &context, cred, &gintoken,
 				      GSS_C_NO_CHANNEL_BINDINGS, &gname,
 				      NULL, &gouttoken, NULL, NULL, NULL);