diff --git a/kdc/pkinit-ec.c b/kdc/pkinit-ec.c
index cbc85bd88..c718aa799 100644
--- a/kdc/pkinit-ec.c
+++ b/kdc/pkinit-ec.c
@@ -34,6 +34,7 @@
  */
 
 #include <config.h>
+#include <roken.h>
 
 #ifdef PKINIT
 
@@ -58,16 +59,10 @@
 #define HEIM_NO_CRYPTO_HDRS
 #endif /* HAVE_HCRYPTO_W_OPENSSL */
 
-#ifdef HAVE_STDINT_H
-#include <stdint.h>
-#endif
-
 #define NO_HCRYPTO_POLLUTION
 
-#include <hcrypto/des.h>
-
 #include "kdc_locl.h"
-
+#include <hcrypto/des.h>
 #include <heim_asn1.h>
 #include <rfc2459_asn1.h>
 #include <cms_asn1.h>
diff --git a/lib/krb5/pkinit-ec.c b/lib/krb5/pkinit-ec.c
index db791d90d..33bc62c8d 100644
--- a/lib/krb5/pkinit-ec.c
+++ b/lib/krb5/pkinit-ec.c
@@ -59,8 +59,6 @@
 #define HEIM_NO_CRYPTO_HDRS
 #endif
 
-#include <config.h>
-
 /*
  * NO_HCRYPTO_POLLUTION -> don't refer to hcrypto type/function names
  * that we don't need in this file and which would clash with OpenSSL's
@@ -74,9 +72,8 @@
  */
 #define NO_HCRYPTO_POLLUTION
 
-#include <hcrypto/des.h>
 #include "krb5_locl.h"
-
+#include <hcrypto/des.h>
 #include <cms_asn1.h>
 #include <pkcs8_asn1.h>
 #include <pkcs9_asn1.h>