diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index 4bc161917..c13abb7ce 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -978,7 +978,7 @@ _kdc_as_rep(krb5_context context,
     krb5_crypto crypto;
     Key *ckey, *skey;
     EncryptionKey *reply_key = NULL, session_key;
-    int flags = 0;
+    int flags = HDB_F_FOR_AS_REQ;
 #ifdef PKINIT
     pk_client_params *pkp = NULL;
 #endif
diff --git a/kdc/krb5tgs.c b/kdc/krb5tgs.c
index 85b0be0e2..58747177c 100644
--- a/kdc/krb5tgs.c
+++ b/kdc/krb5tgs.c
@@ -1508,7 +1508,7 @@ tgs_build_reply(krb5_context context,
 
     Key *tkey_check;
     Key *tkey_sign;
-    int flags = 0;
+    int flags = HDB_F_FOR_TGS_REQ;
 
     memset(&sessionkey, 0, sizeof(sessionkey));
     memset(&adtkt, 0, sizeof(adtkt));