diff --git a/lib/gssapi/accept_sec_context.c b/lib/gssapi/accept_sec_context.c
index 573a4c7fa..7723d9295 100644
--- a/lib/gssapi/accept_sec_context.c
+++ b/lib/gssapi/accept_sec_context.c
@@ -448,7 +448,8 @@ gsskrb5_accept_sec_context
     if(flags & GSS_C_MUTUAL_FLAG) {
 	krb5_data outbuf;
 
-	if (is_cfx) {
+	if (is_cfx != 0
+	    || (ap_options & AP_OPTS_USE_SUBKEY)) {
 	    kret = krb5_auth_con_addflags(gssapi_krb5_context,
 					  (*context_handle)->auth_context,
 					  KRB5_AUTH_CONTEXT_USE_SUBKEY,
diff --git a/lib/gssapi/krb5/accept_sec_context.c b/lib/gssapi/krb5/accept_sec_context.c
index 573a4c7fa..7723d9295 100644
--- a/lib/gssapi/krb5/accept_sec_context.c
+++ b/lib/gssapi/krb5/accept_sec_context.c
@@ -448,7 +448,8 @@ gsskrb5_accept_sec_context
     if(flags & GSS_C_MUTUAL_FLAG) {
 	krb5_data outbuf;
 
-	if (is_cfx) {
+	if (is_cfx != 0
+	    || (ap_options & AP_OPTS_USE_SUBKEY)) {
 	    kret = krb5_auth_con_addflags(gssapi_krb5_context,
 					  (*context_handle)->auth_context,
 					  KRB5_AUTH_CONTEXT_USE_SUBKEY,