diff --git a/bin/named/server.c b/bin/named/server.c
index c1d3f97b75..e7acaaa119 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -8218,7 +8218,8 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) {
 		isc_buffer_putstr(text, "request queued");
 		isc_buffer_putuint8(text, 0);
 	} else if (chain) {
-		CHECK(dns_zone_setnsec3param(zone, hash, flags, iter,
+		CHECK(dns_zone_setnsec3param(zone, (isc_uint8_t)hash,
+					     (isc_uint8_t)flags, iter,
 					     (isc_uint8_t)saltlen, salt,
 					     ISC_TRUE));
 		isc_buffer_putstr(text, "request queued");
diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index 5bc370c6ea..bff339ad22 100644
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -2025,7 +2025,7 @@ dns_zone_keydone(dns_zone_t *zone, const char *data);
 
 isc_result_t
 dns_zone_setnsec3param(dns_zone_t *zone, isc_uint8_t hash, isc_uint8_t flags,
-		       isc_uint8_t iter, isc_uint8_t saltlen,
+		       isc_uint16_t iter, isc_uint8_t saltlen,
 		       unsigned char *salt, isc_boolean_t replace);
 /*%
  * Set the NSEC3 parameters for the zone.
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 54a67be0f9..a051d17a96 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -16571,7 +16571,7 @@ setnsec3param(isc_task_t *task, isc_event_t *event) {
 
 isc_result_t
 dns_zone_setnsec3param(dns_zone_t *zone, isc_uint8_t hash, isc_uint8_t flags,
-		       isc_uint8_t iter, isc_uint8_t saltlen,
+		       isc_uint16_t iter, isc_uint8_t saltlen,
 		       unsigned char *salt, isc_boolean_t replace)
 {
 	isc_result_t result = ISC_R_SUCCESS;