diff --git a/lib/krb5/mk_safe.c b/lib/krb5/mk_safe.c
index 0b057d304..e49272587 100644
--- a/lib/krb5/mk_safe.c
+++ b/lib/krb5/mk_safe.c
@@ -53,6 +53,14 @@ krb5_mk_safe(krb5_context context,
   size_t len;
   u_int32_t tmp_seq;
   krb5_crypto crypto;
+  krb5_keyblock *key;
+
+  if (auth_context->local_subkey)
+      key = auth_context->local_subkey;
+  else if (auth_context->remote_subkey)
+      key = auth_context->remote_subkey;
+  else
+      key = auth_context->keyblock;
 
   s.pvno = 5;
   s.msg_type = krb_safe;
@@ -88,7 +96,7 @@ krb5_mk_safe(krb5_context context,
       free (buf);
       return ret;
   }
-  ret = krb5_crypto_init(context, auth_context->keyblock, 0, &crypto);
+  ret = krb5_crypto_init(context, key, 0, &crypto);
   if (ret) {
       free (buf);
       return ret;