diff --git a/lib/krb5/context.c b/lib/krb5/context.c
index f87eb3fd0..51faf8de9 100644
--- a/lib/krb5/context.c
+++ b/lib/krb5/context.c
@@ -242,9 +242,9 @@ init_context_from_config_file(krb5_context context)
     INIT_FLAG(context, flags, KRB5_CTX_F_ENFORCE_OK_AS_DELEGATE, FALSE, "enforce_ok_as_delegate");
     INIT_FLAG(context, flags, KRB5_CTX_F_REPORT_CANONICAL_CLIENT_NAME, FALSE, "report_canonical_client_name");
 
-    /* need to verify the PAC if we are going to report the canonical client name */
-    if (flags & KRB5_CTX_F_REPORT_CANONICAL_CLIENT_NAME)
-	flags |= KRB5_CTX_F_CHECK_PAC;
+    /* report_canonical_client_name implies check_pac */
+    if (context->flags & KRB5_CTX_F_REPORT_CANONICAL_CLIENT_NAME)
+	context->flags |= KRB5_CTX_F_CHECK_PAC;
 
     if (context->default_cc_name)
 	free(context->default_cc_name);