diff --git a/lib/gssapi/mech/gss_mech_switch.c b/lib/gssapi/mech/gss_mech_switch.c
index 99768b7b0..1826b278b 100644
--- a/lib/gssapi/mech/gss_mech_switch.c
+++ b/lib/gssapi/mech/gss_mech_switch.c
@@ -314,14 +314,6 @@ _gss_load_mech(void)
 		if (found)
 			continue;
 
-#ifndef RTLD_LOCAL
-#define RTLD_LOCAL 0
-#endif
-
-#ifndef RTLD_GROUP
-#define RTLD_GROUP 0
-#endif
-
 		so = dlopen(lib, RTLD_LAZY | RTLD_LOCAL | RTLD_GROUP);
 		if (so == NULL) {
 /*			fprintf(stderr, "dlopen: %s\n", dlerror()); */
diff --git a/lib/hcrypto/engine.c b/lib/hcrypto/engine.c
index 04ba6b645..9cea24821 100644
--- a/lib/hcrypto/engine.c
+++ b/lib/hcrypto/engine.c
@@ -36,13 +36,6 @@
 
 #include <engine.h>
 
-#ifdef HAVE_DLFCN_H
-#include <dlfcn.h>
-#ifndef RTLD_NOW
-#define RTLD_NOW 0
-#endif
-#endif
-
 struct hc_engine {
     int references;
     char *name;
@@ -313,7 +306,7 @@ ENGINE_by_dso(const char *path, const char *id)
     if (engine == NULL)
 	return NULL;
 
-    handle = dlopen(path, RTLD_NOW);
+    handle = dlopen(path, RTLD_NOW | RTLD_LOCAL | RTLD_GROUP);
     if (handle == NULL) {
 	/* printf("error: %s\n", dlerror()); */
 	free(engine);
diff --git a/lib/hcrypto/evp-pkcs11.c b/lib/hcrypto/evp-pkcs11.c
index 5a525d100..0e2227923 100644
--- a/lib/hcrypto/evp-pkcs11.c
+++ b/lib/hcrypto/evp-pkcs11.c
@@ -33,21 +33,8 @@
 #include <config.h>
 #include <roken.h>
 #include <assert.h>
-#ifdef HAVE_DLFCN_H
-#include <dlfcn.h>
-#ifndef RTLD_LAZY
-#define RTLD_LAZY 0
-#endif
-#ifndef RTLD_LOCAL
-#define RTLD_LOCAL 0
-#endif
-#ifndef RTLD_GROUP
-#define RTLD_GROUP 0
-#endif
-#ifndef RTLD_NODELETE
-#define RTLD_NODELETE 0
-#endif
-#else
+
+#ifndef HAVE_DLFCN_H
 #error PKCS11 support requires dlfcn.h
 #endif
 
diff --git a/lib/hx509/ks_p11.c b/lib/hx509/ks_p11.c
index 795f82f46..7fe5872a1 100644
--- a/lib/hx509/ks_p11.c
+++ b/lib/hx509/ks_p11.c
@@ -32,9 +32,6 @@
  */
 
 #include "hx_locl.h"
-#ifdef HAVE_DLFCN_H
-#include <dlfcn.h>
-#endif
 
 #ifdef HAVE_DLOPEN
 
@@ -849,7 +846,7 @@ p11_init(hx509_context context,
 	str = strnext;
     }
 
-    p->dl_handle = dlopen(list, RTLD_NOW);
+    p->dl_handle = dlopen(list, RTLD_NOW | RTLD_LOCAL | RTLD_GROUP);
     if (p->dl_handle == NULL) {
 	ret = HX509_PKCS11_LOAD;
 	hx509_set_error_string(context, 0, ret,
diff --git a/lib/kadm5/password_quality.c b/lib/kadm5/password_quality.c
index e7304c4fa..84c1d3997 100644
--- a/lib/kadm5/password_quality.c
+++ b/lib/kadm5/password_quality.c
@@ -37,9 +37,6 @@
 #ifdef HAVE_SYS_WAIT_H
 #include <sys/wait.h>
 #endif
-#ifdef HAVE_DLFCN_H
-#include <dlfcn.h>
-#endif
 
 static int
 min_length_passwd_quality (krb5_context context,
@@ -250,10 +247,6 @@ static int num_verifiers;
  * setup the password quality hook
  */
 
-#ifndef RTLD_NOW
-#define RTLD_NOW 0
-#endif
-
 void
 kadm5_setup_passwd_quality_check(krb5_context context,
 				 const char *check_library,
@@ -286,7 +279,7 @@ kadm5_setup_passwd_quality_check(krb5_context context,
 
     if(check_library == NULL)
 	return;
-    handle = dlopen(check_library, RTLD_NOW);
+    handle = dlopen(check_library, RTLD_NOW | RTLD_LOCAL | RTLD_GROUP);
     if(handle == NULL) {
 	krb5_warnx(context, "failed to open `%s'", check_library);
 	return;
@@ -326,7 +319,7 @@ add_verifier(krb5_context context, const char *check_library)
     void *handle;
     int i;
 
-    handle = dlopen(check_library, RTLD_NOW);
+    handle = dlopen(check_library, RTLD_NOW | RTLD_LOCAL | RTLD_GROUP);
     if(handle == NULL) {
 	krb5_warnx(context, "failed to open `%s'", check_library);
 	return ENOENT;
diff --git a/lib/krb5/acache.c b/lib/krb5/acache.c
index 9d33df133..4cadb5de5 100644
--- a/lib/krb5/acache.c
+++ b/lib/krb5/acache.c
@@ -35,9 +35,6 @@
 
 #include "krb5_locl.h"
 #include <krb5_ccapi.h>
-#ifdef HAVE_DLFCN_H
-#include <dlfcn.h>
-#endif
 
 #ifndef KCM_IS_API_CACHE
 
@@ -115,23 +112,16 @@ init_ccapi(krb5_context context)
 
 #ifdef HAVE_DLOPEN
 
-#ifndef RTLD_LAZY
-#define RTLD_LAZY 0
-#endif
-#ifndef RTLD_LOCAL
-#define RTLD_LOCAL 0
-#endif
-
 #ifdef KRB5_USE_PATH_TOKENS
     {
       char * explib = NULL;
       if (_krb5_expand_path_tokens(context, lib, 0, &explib) == 0) {
-	cc_handle = dlopen(explib, RTLD_LAZY|RTLD_LOCAL);
+	cc_handle = dlopen(explib, RTLD_LAZY|RTLD_LOCAL|RTLD_GROUP);
 	free(explib);
       }
     }
 #else
-    cc_handle = dlopen(lib, RTLD_LAZY|RTLD_LOCAL);
+    cc_handle = dlopen(lib, RTLD_LAZY|RTLD_LOCAL|RTLD_GROUP);
 #endif
 
     if (cc_handle == NULL) {
diff --git a/lib/krb5/plugin.c b/lib/krb5/plugin.c
index 0661c7591..a93952e43 100644
--- a/lib/krb5/plugin.c
+++ b/lib/krb5/plugin.c
@@ -35,11 +35,6 @@
 
 #include "krb5_locl.h"
 
-#ifdef HAVE_DLFCN_H
-#include <dlfcn.h>
-#endif
-#include <dirent.h>
-
 /*
  * Definitions:
  *
diff --git a/lib/roken/roken-common.h b/lib/roken/roken-common.h
index 9810862ac..267643dc7 100644
--- a/lib/roken/roken-common.h
+++ b/lib/roken/roken-common.h
@@ -292,6 +292,33 @@
 #define __attribute__(x)
 #endif
 
+/*
+ * for dlopen(3)
+ */
+#ifndef RTLD_LAZY
+#define RTLD_LAZY 0
+#endif
+
+#ifndef RTLD_NOW
+#define RTLD_NOW 0
+#endif
+
+#ifndef RTLD_GLOBAL
+#define RTLD_GLOBAL 0
+#endif
+
+#ifndef RTLD_LOCAL
+#define RTLD_LOCAL 0
+#endif
+
+#ifndef RTLD_GROUP
+#define RTLD_GROUP 0
+#endif
+
+#ifndef RTLD_NODELETE
+#define RTLD_NODELETE 0
+#endif
+
 ROKEN_CPP_START
 
 #ifndef IRIX4 /* fix for compiler bug */
diff --git a/lib/roken/roken.h.in b/lib/roken/roken.h.in
index d37c7a5b2..f3cd84b75 100644
--- a/lib/roken/roken.h.in
+++ b/lib/roken/roken.h.in
@@ -296,6 +296,10 @@ struct sockaddr_dl;
 #include <paths.h>
 #endif
 
+#ifdef HAVE_DLFCN_H
+#include <dlfcn.h>
+#endif
+
 #ifdef HAVE_DIRENT_H
 #include <dirent.h>
 #endif