diff --git a/configure b/configure
index 81818c563e..f8ebd0815e 100755
--- a/configure
+++ b/configure
@@ -882,6 +882,8 @@ ISC_PLATFORM_NORETURN_PRE
 ISC_PLATFORM_HAVELONGLONG
 ISC_SOCKADDR_LEN_T
 expanded_sysconfdir
+PYTHON_INSTALL_LIB
+PYTHON_INSTALL_DIR
 PYTHON_TOOLS
 KEYMGR
 COVERAGE
@@ -1006,6 +1008,7 @@ enable_developer
 enable_afl
 enable_seccomp
 with_python
+with_python_install_dir
 enable_kqueue
 enable_epoll
 enable_devpoll
@@ -1742,6 +1745,8 @@ Optional Packages:
   --with-sysroot=DIR Search for dependent libraries within DIR
                         (or the compiler's sysroot if not specified).
   --with-python=PATH      specify path to python interpreter
+  --with-python-install-dir=PATH
+                          installation directory for Python modules
   --with-geoip=PATH       Build with GeoIP support (yes|no|path)
   --with-gssapi=[PATH|[/path/]krb5-config]      Specify path for system-supplied GSSAPI [default=yes]
   --with-randomdev=PATH   Specify path for random device
@@ -11848,6 +11853,14 @@ else
 fi
 
 
+# Check whether --with-python-install-dir was given.
+if test "${with_python_install_dir+set}" = set; then :
+  withval=$with_python_install_dir; use_python_install_dir="$withval"
+else
+  use_python_install_dir="unspec"
+fi
+
+
 python="python python3 python3.5 python3.4 python3.3 python3.2 python2 python2.7"
 
 testargparse='try: import argparse
@@ -11958,8 +11971,19 @@ $as_echo "not found" >&6; }
                                         unset PYTHON
 				fi
 			done
-			if test "X$PYTHON" = "X"
+			if test "X$PYTHON" != "X"
 			then
+				case "$use_python_install_dir" in
+				unspec)
+					PYTHON_INSTALL_DIR=""
+					PYTHON_INSTALL_LIB=""
+					;;
+				*)
+					PYTHON_INSTALL_DIR="$use_python_install_dir"
+					PYTHON_INSTALL_LIB="--install-lib=$use_python_install_dir"
+					;;
+				esac
+			else
 				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for python support" >&5
 $as_echo_n "checking for python support... " >&6; }
 				case "$use_python" in
@@ -12070,6 +12094,8 @@ fi
 
 
 
+
+
 #
 # Special processing of paths depending on whether --prefix,
 # --sysconfdir or --localstatedir arguments were given.  What's
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index fb21d8b070..bf34e44f79 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -4452,6 +4452,12 @@ options {
                   to be 128 bits for AES128, 160 bits for SHA1 and
                   256 bits for SHA256.
                 </p>
+                <p>
+                  If there are multiple secrets specified, the first
+                  one listed in <code class="filename">named.conf</code> is
+                  used to generate new server cookies.  The others
+                  will only be used to verify returned cookies.
+                </p>
               </dd>
 <dt><span class="term"><span class="command"><strong>response-padding</strong></span></span></dt>
 <dd>
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 26f948833e..1dc3973eff 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -570,6 +570,16 @@
 	  validator messages.
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  Multiple <span class="command"><strong>cookie-secret</strong></span> clause are now
+	  supported.  The first <span class="command"><strong>cookie-secret</strong></span> in
+	  <code class="filename">named.conf</code> is used to generate new
+	  server cookies.  Any others are used to accept old server
+	  cookies or those generated by other servers using the
+	  matching <span class="command"><strong>cookie-secret</strong></span>.
+	</p>
+      </li>
 </ul></div>
   </div>
 
diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index 026d9b82e9..ea2fff7437 100644
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -531,6 +531,16 @@
 	  validator messages.
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  Multiple <span class="command"><strong>cookie-secret</strong></span> clause are now
+	  supported.  The first <span class="command"><strong>cookie-secret</strong></span> in
+	  <code class="filename">named.conf</code> is used to generate new
+	  server cookies.  Any others are used to accept old server
+	  cookies or those generated by other servers using the
+	  matching <span class="command"><strong>cookie-secret</strong></span>.
+	</p>
+      </li>
 </ul></div>
   </div>
 
diff --git a/doc/misc/options b/doc/misc/options
index 7c29d94cb3..1c06be4153 100644
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -114,7 +114,7 @@ options {
         cleaning-interval <integer>;
         clients-per-query <integer>;
         cookie-algorithm ( aes | sha1 | sha256 );
-        cookie-secret <string>;
+        cookie-secret <string>; // may occur multiple times
         coresize ( default | unlimited | <sizeval> );
         datasize ( default | unlimited | <sizeval> );
         deallocate-on-exit <boolean>; // obsolete