diff --git a/bin/tests/system/conf.sh.common b/bin/tests/system/conf.sh.common
index ac1845860f..07106836a3 100644
--- a/bin/tests/system/conf.sh.common
+++ b/bin/tests/system/conf.sh.common
@@ -713,6 +713,7 @@ export KEYGEN
 export KEYSETTOOL
 export KEYSIGNER
 export KRB5_CONFIG
+export KRB5_KTNAME
 export MAKEJOURNAL
 export MDIG
 export NAMED
diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
index 9f4524b708..8b0621c052 100644
--- a/bin/tests/system/conf.sh.in
+++ b/bin/tests/system/conf.sh.in
@@ -71,6 +71,8 @@ PIPEQUERIES=$TOP_BUILDDIR/bin/tests/system/pipelined/pipequeries
 
 # we don't want a KRB5_CONFIG setting breaking the tests
 KRB5_CONFIG=/dev/null
+# use local keytab instead of default /etc/krb5.keytab
+KRB5_KTNAME=dns.keytab
 
 #
 # Construct the lists of tests to run
diff --git a/bin/tests/system/nsupdate/krb/setup.sh b/bin/tests/system/nsupdate/krb/setup.sh
index 3fef030bd1..150b2050f8 100644
--- a/bin/tests/system/nsupdate/krb/setup.sh
+++ b/bin/tests/system/nsupdate/krb/setup.sh
@@ -101,7 +101,7 @@ kinit -V -k -t krb5-machine.keytab -l ${lifetime}d -c krb5-machine.ccache host/m
 kinit -V -k -t ms-machine.keytab -l ${lifetime}d -c ms-machine.ccache 'machine$@EXAMPLE.COM'
 
 cp ns7-server.keytab ../ns7/dns.keytab
-cp ns8-server.keytab ../ns8/dns.keytab
+cp ns8-server.keytab ../ns8/dns-other-than-KRB5_KTNAME.keytab
 cp ns9-server.keytab ../ns9/dns.keytab
 cp ns10-server.keytab ../ns10/dns.keytab
 
diff --git a/bin/tests/system/nsupdate/ns10/named.conf.in b/bin/tests/system/nsupdate/ns10/named.conf.in
index 457d96b4f8..0e2fb06782 100644
--- a/bin/tests/system/nsupdate/ns10/named.conf.in
+++ b/bin/tests/system/nsupdate/ns10/named.conf.in
@@ -20,7 +20,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
-	tkey-gssapi-keytab "dns.keytab";
+	tkey-gssapi-credential "DNS/ns10.example.com@EXAMPLE.COM";
 };
 
 key rndc_key {
diff --git a/bin/tests/system/nsupdate/ns8/dns.keytab b/bin/tests/system/nsupdate/ns8/dns-other-than-KRB5_KTNAME.keytab
similarity index 100%
rename from bin/tests/system/nsupdate/ns8/dns.keytab
rename to bin/tests/system/nsupdate/ns8/dns-other-than-KRB5_KTNAME.keytab
diff --git a/bin/tests/system/nsupdate/ns8/named.conf.in b/bin/tests/system/nsupdate/ns8/named.conf.in
index 92792db680..dac45d9141 100644
--- a/bin/tests/system/nsupdate/ns8/named.conf.in
+++ b/bin/tests/system/nsupdate/ns8/named.conf.in
@@ -20,7 +20,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
-	tkey-gssapi-keytab "dns.keytab";
+	tkey-gssapi-keytab "dns-other-than-KRB5_KTNAME.keytab";
 };
 
 key rndc_key {
diff --git a/bin/tests/system/nsupdate/ns9/named.conf.in b/bin/tests/system/nsupdate/ns9/named.conf.in
index a65f069ac7..f95ea4ed26 100644
--- a/bin/tests/system/nsupdate/ns9/named.conf.in
+++ b/bin/tests/system/nsupdate/ns9/named.conf.in
@@ -20,7 +20,7 @@ options {
 	recursion no;
 	notify yes;
 	minimal-responses no;
-	tkey-gssapi-keytab "dns.keytab";
+	tkey-gssapi-credential "DNS/ns9.example.com@EXAMPLE.COM";
 };
 
 key rndc_key {
diff --git a/util/copyrights b/util/copyrights
index e1c7d591a7..92de9fbad9 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -654,7 +654,7 @@
 ./bin/tests/system/nsupdate/ns6/named.args	X	2018,2019,2020,2021
 ./bin/tests/system/nsupdate/ns7/dns.keytab	X	2018,2019,2020,2021
 ./bin/tests/system/nsupdate/ns7/machine.ccache	X	2018,2019,2020,2021
-./bin/tests/system/nsupdate/ns8/dns.keytab	X	2018,2019,2020,2021
+./bin/tests/system/nsupdate/ns8/dns-other-than-KRB5_KTNAME.keytab	X	2018,2019,2020,2021
 ./bin/tests/system/nsupdate/ns8/machine.ccache	X	2018,2019,2020,2021
 ./bin/tests/system/nsupdate/ns9/dns.keytab	X	2018,2019,2020,2021
 ./bin/tests/system/nsupdate/ns9/machine.ccache	X	2018,2019,2020,2021