diff --git a/CHANGES b/CHANGES
index cced392050..a0d5f8df46 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3096.	[bug]		Set KRB5_KTNAME before calling log_cred() in
+			dst_gssapi_acceptctx(). [RT #24004]
+
 3095.	[bug]		Handle isolated reserved ports in the port range.
 			[RT #23957]
 
diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index 744f5b77a4..f5dfdbfdb0 100644
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: gssapictx.c,v 1.12.118.7 2011/03/28 23:45:57 tbox Exp $ */
+/* $Id: gssapictx.c,v 1.12.118.8 2011/04/07 23:07:37 marka Exp $ */
 
 #include <config.h>
 
@@ -617,8 +617,6 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
 
 	REQUIRE(outtoken != NULL && *outtoken == NULL);
 
-	log_cred(cred);
-
 	REGION_TO_GBUFFER(*intoken, gintoken);
 
 	if (*ctxout == NULL)
@@ -626,6 +624,8 @@ dst_gssapi_acceptctx(gss_cred_id_t cred,
 	else
 		context = *ctxout;
 
+	log_cred(cred);
+
 	gret = gss_accept_sec_context(&minor, &context, cred, &gintoken,
 				      GSS_C_NO_CHANNEL_BINDINGS, &gname,
 				      NULL, &gouttoken, NULL, NULL, NULL);