diff --git a/CHANGES b/CHANGES
index b67ec24a99..f630768769 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4653.	[bug]		Reorder includes in bin/nsupdate/Makefile.in.
+			[RT #45581]
+
 4652.	[bug]		Nsupdate could attempt to use a zeroed address on
 			server timeout. [RT #45417]
 
diff --git a/bin/nsupdate/Makefile.in b/bin/nsupdate/Makefile.in
index 1a5ae2a52e..63997fc540 100644
--- a/bin/nsupdate/Makefile.in
+++ b/bin/nsupdate/Makefile.in
@@ -19,8 +19,8 @@ READLINE_LIB = @READLINE_LIB@
 DST_GSSAPI_INC = @DST_GSSAPI_INC@
 
 CINCLUDES =	${LWRES_INCLUDES} ${DNS_INCLUDES} \
-		${BIND9_INCLUDES} @DST_OPENSSL_INC@ ${ISC_INCLUDES} \
-		${ISCCFG_INCLUDES} ${DST_GSSAPI_INC}
+		${BIND9_INCLUDES} ${ISC_INCLUDES} \
+		${ISCCFG_INCLUDES} ${DST_GSSAPI_INC} @DST_OPENSSL_INC@
 
 CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@ @USE_GSSAPI@
 CWARNINGS =