diff --git a/CHANGES b/CHANGES
index 892a2107a0..27bf2ce4de 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+5062.	[func]		Use non-crypto-secure PRNG to generate nonces for
+			cookies [GL !887]
+
 5061.	[protocol]	Add support for EID and NIMLOC. [GL #626]
 
 5060.	[bug]		GID, UID and UINFO could not be loaded using unknown
diff --git a/lib/ns/client.c b/lib/ns/client.c
index 32c8ddfe22..7b789047e6 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -1656,7 +1656,7 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 		isc_buffer_init(&buf, cookie, sizeof(cookie));
 		isc_stdtime_get(&now);
 
-		isc_nonce_buf(&nonce, sizeof(nonce));
+		isc_random_buf(&nonce, sizeof(nonce));
 
 		compute_cookie(client, now, nonce, client->sctx->secret, &buf);