diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index d692690d9..d5ed93994 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -2743,7 +2743,10 @@ _kdc_as_rep(astgs_request_t r)
     }
 
 out:
-    r->error_code = ret;
+    if (ret) {
+	/* Overwrite ‘error_code’ only if we have an actual error. */
+	r->error_code = ret;
+    }
     {
 	krb5_error_code ret2 = _kdc_audit_request(r);
 	if (ret2) {
diff --git a/kdc/krb5tgs.c b/kdc/krb5tgs.c
index 06c42df20..77e2d1de9 100644
--- a/kdc/krb5tgs.c
+++ b/kdc/krb5tgs.c
@@ -2161,7 +2161,10 @@ _kdc_tgs_rep(astgs_request_t r)
     }
 
 out:
-    r->error_code = ret;
+    if (ret) {
+	/* Overwrite ‘error_code’ only if we have an actual error. */
+	r->error_code = ret;
+    }
     {
 	krb5_error_code ret2 = _kdc_audit_request(r);
 	if (ret2) {