diff --git a/lib/kadm5/chpass_s.c b/lib/kadm5/chpass_s.c
index 85a90faca..860f563a5 100644
--- a/lib/kadm5/chpass_s.c
+++ b/lib/kadm5/chpass_s.c
@@ -92,14 +92,17 @@ change(void *server_handle,
     if (ret)
 	goto out2;
 
+    ret = context->db->hdb_store(context->context, context->db, 
+				 HDB_F_REPLACE, &ent);
+    if (ret)
+	goto out2;
+
     kadm5_log_modify (context,
 		      &ent.entry,
 		      KADM5_PRINCIPAL | KADM5_MOD_NAME | KADM5_MOD_TIME |
 		      KADM5_KEY_DATA | KADM5_KVNO | KADM5_PW_EXPIRATION |
 		      KADM5_TL_DATA);
-    
-    ret = context->db->hdb_store(context->context, context->db, 
-				 HDB_F_REPLACE, &ent);
+
 out2:
     hdb_free_entry(context->context, &ent);
 out:
@@ -170,14 +173,17 @@ kadm5_s_chpass_principal_with_key(void *server_handle,
     if (ret)
 	goto out2;
 
+    ret = context->db->hdb_store(context->context, context->db, 
+				 HDB_F_REPLACE, &ent);
+    if (ret)
+	goto out2;
+
     kadm5_log_modify (context,
 		      &ent.entry,
 		      KADM5_PRINCIPAL | KADM5_MOD_NAME | KADM5_MOD_TIME |
 		      KADM5_KEY_DATA | KADM5_KVNO | KADM5_PW_EXPIRATION |
 		      KADM5_TL_DATA);
-    
-    ret = context->db->hdb_store(context->context, context->db, 
-				 HDB_F_REPLACE, &ent);
+
 out2:
     hdb_free_entry(context->context, &ent);
 out: