diff --git a/CHANGES b/CHANGES
index 03b5b7230a..6aac08effd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4881.	[bug]		Only include dst_openssl.h when OpenSSL is required.
+			[RT #47068]
+
 4880.	[bug]		Named wasn't returning the target of a cross zone
 			CNAME between to served zones when recursion was
 			desired and available (RD=1, RA=1). Don't return
diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c
index aa848f821d..cc0f750009 100644
--- a/lib/dns/hmac_link.c
+++ b/lib/dns/hmac_link.c
@@ -41,7 +41,9 @@
 #include <dst/result.h>
 
 #include "dst_internal.h"
-#include "dst_openssl.h"
+#ifdef HAVE_FIPS_MODE
+#include "dst_openssl.h"	/* FIPS_mode() prototype */
+#endif
 #include "dst_parse.h"
 
 #ifndef PK11_MD5_DISABLE