diff --git a/lib/krb5/context.c b/lib/krb5/context.c
index 847cd3602..a77e9974d 100644
--- a/lib/krb5/context.c
+++ b/lib/krb5/context.c
@@ -1108,10 +1108,10 @@ krb5_kerberos_enctypes(krb5_context context)
     };
 
     static const krb5_enctype weak[] = {
-	ETYPE_AES256_CTS_HMAC_SHA1_96,
-	ETYPE_AES128_CTS_HMAC_SHA1_96,
 	ETYPE_AES256_CTS_HMAC_SHA384_192,
 	ETYPE_AES128_CTS_HMAC_SHA256_128,
+	ETYPE_AES256_CTS_HMAC_SHA1_96,
+	ETYPE_AES128_CTS_HMAC_SHA1_96,
 	ETYPE_ARCFOUR_HMAC_MD5,
 	ETYPE_NULL
     };