diff --git a/lib/kadm5/create_s.c b/lib/kadm5/create_s.c
index a9249ccf0..11be15a81 100644
--- a/lib/kadm5/create_s.c
+++ b/lib/kadm5/create_s.c
@@ -94,6 +94,10 @@ kadm5_s_create_principal(void *server_handle,
     ent.keys.len = 2;
     ent.keys.val = calloc(ent.keys.len, sizeof(*ent.keys.val));
     ent.keys.val[0].key.keytype = KEYTYPE_DES;
+    /* flag as version 4 compatible salt; ignored by _kadm5_set_keys
+       if we don't want to be compatible */
+    ent.keys.val[0].salt = calloc(sizeof(*end.keys.val[0].salt));
+    ent.keys.val[0].salt->type = hdb_pw_salt;
     ent.keys.val[1].key.keytype = KEYTYPE_DES3;
 
     ret = _kadm5_set_keys(context, &ent, password);