diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index 5d5f48a2b..0ee6e2439 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -1519,8 +1519,6 @@ add_enc_pa_rep(kdc_request_t r)
     krb5_data cdata;
     size_t len;
 
-    r->et.flags.enc_pa_rep = r->ek.flags.enc_pa_rep = 1;
-
     ret = krb5_crypto_init(r->context, &r->reply_key, 0, &crypto);
     if (ret)
 	return ret;
@@ -2145,6 +2143,12 @@ _kdc_as_rep(kdc_request_t r,
 
     log_as_req(context, config, r->reply_key.keytype, setype, b);
 
+    /*
+     * We always say we support FAST/enc-pa-rep
+     */
+
+    r->et.flags.enc_pa_rep = r->ek.flags.enc_pa_rep = 1;
+
     /*
      * Add REQ_ENC_PA_REP if client supports it
      */