diff --git a/lib/krb5/get_cred.c b/lib/krb5/get_cred.c
index 57ccbb13b..d4cfcf947 100644
--- a/lib/krb5/get_cred.c
+++ b/lib/krb5/get_cred.c
@@ -1191,6 +1191,10 @@ krb5_get_creds(krb5_context context,
 	flags.b.forwardable = 1;
     if (options & KRB5_GC_NO_TRANSIT_CHECK)
 	flags.b.disable_transited_check = 1;
+    if (options & KRB5_GC_CONSTRAINED_DELEGATION) {
+	flags.b.request_anonymous = 1; /* XXX ARGH confusion */
+	flags.b.constrained_delegation = 1;
+    }
 
     tgts = NULL;
     ret = get_cred_from_kdc_flags(context, flags, ccache,