diff --git a/lib/krb5/init_creds_pw.c b/lib/krb5/init_creds_pw.c
index 0b75522e9..4cea216da 100644
--- a/lib/krb5/init_creds_pw.c
+++ b/lib/krb5/init_creds_pw.c
@@ -1244,7 +1244,7 @@ init_cred_loop(krb5_context context,
 
     /* Set a new nonce. */
     krb5_generate_random_block (&ctx->nonce, sizeof(ctx->nonce));
-    ctx->nonce &= 0xffffffff;
+    ctx->nonce &= 0x7fffffff;
     /* XXX these just needs to be the same when using Windows PK-INIT */
     ctx->pk_nonce = ctx->nonce;