diff --git a/bin/dnssec/dnssec-makekeyset.c b/bin/dnssec/dnssec-makekeyset.c
index 9152e61a04..86edeebce2 100644
--- a/bin/dnssec/dnssec-makekeyset.c
+++ b/bin/dnssec/dnssec-makekeyset.c
@@ -343,6 +343,7 @@ main(int argc, char *argv[]) {
 		result = dns_dnssec_sign(domain, &rdataset, keynode->key,
 					 &starttime, &endtime, mctx, &b,
 					 rdata);
+		isc_entropy_stopcallbacksources(ectx);
 		if (result != ISC_R_SUCCESS)
 			fatal("failed to sign keyset with key %s/%s/%d: %s",
 			      nametostr(dst_key_name(keynode->key)),
diff --git a/bin/dnssec/dnssec-signkey.c b/bin/dnssec/dnssec-signkey.c
index 64dd987cee..559e65ef91 100644
--- a/bin/dnssec/dnssec-signkey.c
+++ b/bin/dnssec/dnssec-signkey.c
@@ -325,6 +325,7 @@ main(int argc, char *argv[]) {
 		result = dns_dnssec_sign(domain, &rdataset, key,
 					 &sig.timesigned, &sig.timeexpire,
 					 mctx, &b, rdata);
+		isc_entropy_stopcallbacksources(ectx);
 		if (result != ISC_R_SUCCESS)
 			fatal("key '%s/%s/%d' failed to sign data: %s",
 			      nametostr(dst_key_name(key)),
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index c9ec16125c..4e2bb94dcb 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -99,6 +99,7 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dns_rdata_t *rdata,
 	dns_rdata_init(rdata);
 	result = dns_dnssec_sign(name, rdataset, key, &starttime, &endtime,
 				 mctx, b, rdata);
+	isc_entropy_stopcallbacksources(ectx);
 	if (result != ISC_R_SUCCESS)
 		fatal("key '%s/%s/%d' failed to sign data: %s",
 		      nametostr(dst_key_name(key)), algtostr(dst_key_alg(key)),