diff --git a/bin/named/server.c b/bin/named/server.c
index ee254c15eb..9ed8e7b2ff 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -8117,7 +8117,8 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) {
 		isc_buffer_putstr(text, "request queued");
 		isc_buffer_putuint8(text, 0);
 	} else if (chain) {
-		CHECK(dns_zone_setnsec3param(zone, hash, flags, iter,
+		CHECK(dns_zone_setnsec3param(zone, (isc_uint8_t)hash,
+					     (isc_uint8_t)flags, iter,
 					     (isc_uint8_t)saltlen, salt,
 					     ISC_TRUE));
 		isc_buffer_putstr(text, "request queued");
diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index dda14b7be9..fe00468d4d 100644
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -2029,7 +2029,7 @@ dns_zone_keydone(dns_zone_t *zone, const char *data);
 
 isc_result_t
 dns_zone_setnsec3param(dns_zone_t *zone, isc_uint8_t hash, isc_uint8_t flags,
-		       isc_uint8_t iter, isc_uint8_t saltlen,
+		       isc_uint16_t iter, isc_uint8_t saltlen,
 		       unsigned char *salt, isc_boolean_t replace);
 /*%
  * Set the NSEC3 parameters for the zone.
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 37c368c9b8..9d3897f7e8 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -16471,7 +16471,7 @@ setnsec3param(isc_task_t *task, isc_event_t *event) {
 
 isc_result_t
 dns_zone_setnsec3param(dns_zone_t *zone, isc_uint8_t hash, isc_uint8_t flags,
-		       isc_uint8_t iter, isc_uint8_t saltlen,
+		       isc_uint16_t iter, isc_uint8_t saltlen,
 		       unsigned char *salt, isc_boolean_t replace)
 {
 	isc_result_t result = ISC_R_SUCCESS;