diff --git a/CHANGES b/CHANGES
index f630768769..b7f7ad6f02 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,5 @@
-4653.	[bug]		Reorder includes in bin/nsupdate/Makefile.in.
+4653.	[bug]		Reorder includes to move @DST_OPENSSL_INC@ and
+			@ISC_OPENSSL_INC@ after shipped include directories.
 			[RT #45581]
 
 4652.	[bug]		Nsupdate could attempt to use a zeroed address on
diff --git a/bin/delv/Makefile.in b/bin/delv/Makefile.in
index e14968f711..f77c94fa6d 100644
--- a/bin/delv/Makefile.in
+++ b/bin/delv/Makefile.in
@@ -13,7 +13,7 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${ISC_INCLUDES} \
-		@DST_OPENSSL_INC@ ${IRS_INCLUDES} ${ISCCFG_INCLUDES}
+		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @DST_OPENSSL_INC@
 
 CDEFINES =	@CRYPTO@ -DVERSION=\"${VERSION}\" \
 		-DSYSCONFDIR=\"${sysconfdir}\"
diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
index bd219c5d05..161d0e9ef4 100644
--- a/bin/dig/Makefile.in
+++ b/bin/dig/Makefile.in
@@ -14,9 +14,9 @@ VERSION=@BIND9_VERSION@
 
 READLINE_LIB = @READLINE_LIB@
 
-CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${BIND9_INCLUDES} \
-		${ISC_INCLUDES} @DST_OPENSSL_INC@ \
-		${LWRES_INCLUDES} ${ISCCFG_INCLUDES}
+CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
+		${BIND9_INCLUDES} ${ISC_INCLUDES} \
+		${LWRES_INCLUDES} ${ISCCFG_INCLUDES} @DST_OPENSSL_INC@
 
 CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@
 CWARNINGS =
diff --git a/bin/tests/Makefile.in b/bin/tests/Makefile.in
index 52164d6322..533683090d 100644
--- a/bin/tests/Makefile.in
+++ b/bin/tests/Makefile.in
@@ -10,8 +10,8 @@ top_srcdir =	@top_srcdir@
 
 @BIND9_MAKE_INCLUDES@
 
-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@ \
-		${ISCCFG_INCLUDES} ${LWRES_INCLUDES} ${OMAPI_INCLUDES}
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
+		${LWRES_INCLUDES} ${OMAPI_INCLUDES} @DST_OPENSSL_INC@
 
 CDEFINES =	@CRYPTO@
 CWARNINGS =
diff --git a/bin/tools/Makefile.in b/bin/tools/Makefile.in
index 36d7b8dc01..97b7544307 100644
--- a/bin/tools/Makefile.in
+++ b/bin/tools/Makefile.in
@@ -12,9 +12,9 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@ \
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} \
 		${ISCCFG_INCLUDES} ${LWRES_INCLUDES} \
-		${OMAPI_INCLUDES} ${BIND9_INCLUDES}
+		${OMAPI_INCLUDES} ${BIND9_INCLUDES} @DST_OPENSSL_INC@ 
 
 CDEFINES =	@CRYPTO@ -DVERSION=\"${VERSION}\"
 CWARNINGS =
diff --git a/lib/bind9/Makefile.in b/lib/bind9/Makefile.in
index a98926e733..70d68547c9 100644
--- a/lib/bind9/Makefile.in
+++ b/lib/bind9/Makefile.in
@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 
 CINCLUDES =	-I. ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
-		@ISC_OPENSSL_INC@ ${ISCCFG_INCLUDES}
+		${ISCCFG_INCLUDES} @ISC_OPENSSL_INC@
 
 CDEFINES =	@CRYPTO@
 CWARNINGS =
diff --git a/lib/irs/Makefile.in b/lib/irs/Makefile.in
index 65d3f289ca..411fdd334e 100644
--- a/lib/irs/Makefile.in
+++ b/lib/irs/Makefile.in
@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
 
 CINCLUDES =	-I. -I./include -I${srcdir}/include \
 		${DNS_INCLUDES} ${ISC_INCLUDES} \
-		@ISC_OPENSSL_INC@ ${ISCCFG_INCLUDES}
+		${ISCCFG_INCLUDES} @ISC_OPENSSL_INC@
 
 CDEFINES =	@CRYPTO@
 CWARNINGS =
diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
index 3e0a7e3e5d..bd8b109148 100644
--- a/lib/isc/Makefile.in
+++ b/lib/isc/Makefile.in
@@ -20,7 +20,7 @@ CINCLUDES =	-I${srcdir}/unix/include \
 		-I${srcdir}/@ISC_THREAD_DIR@/include \
 		-I${srcdir}/@ISC_ARCH_DIR@/include \
 		-I./include \
-		-I${srcdir}/include @ISC_OPENSSL_INC@ ${DNS_INCLUDES}
+		-I${srcdir}/include ${DNS_INCLUDES} @ISC_OPENSSL_INC@
 CDEFINES =	@CRYPTO@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
 CWARNINGS =
 
diff --git a/lib/isc/unix/Makefile.in b/lib/isc/unix/Makefile.in
index 8dc43632e7..a55ff7e9e3 100644
--- a/lib/isc/unix/Makefile.in
+++ b/lib/isc/unix/Makefile.in
@@ -11,8 +11,8 @@ top_srcdir =	@top_srcdir@
 CINCLUDES =	-I${srcdir}/include \
 		-I${srcdir}/../@ISC_THREAD_DIR@/include \
 		-I../include \
-		-I${srcdir}/../include @ISC_OPENSSL_INC@ \
-		-I${srcdir}/..
+		-I${srcdir}/../include \
+		-I${srcdir}/.. @ISC_OPENSSL_INC@
 
 CDEFINES =	@CRYPTO@
 CWARNINGS =
diff --git a/lib/samples/Makefile.in b/lib/samples/Makefile.in
index 6e2e8a76c2..cd9c82559c 100644
--- a/lib/samples/Makefile.in
+++ b/lib/samples/Makefile.in
@@ -14,8 +14,8 @@ VERSION=@BIND9_VERSION@
 
 CINCLUDES =	-I${srcdir}/include -I../dns/include \
 		${DNS_INCLUDES} ${ISC_INCLUDES} \
-		@ISC_OPENSSL_INC@ -I${top_srcdir}/lib/irs/include \
-		-I../../lib/irs/include
+		-I${top_srcdir}/lib/irs/include \
+		-I../../lib/irs/include @ISC_OPENSSL_INC@
 
 CDEFINES =	@CRYPTO@ -DVERSION=\"${VERSION}\" \
 		-DSYSCONFDIR=\"${sysconfdir}\"