diff --git a/CHANGES b/CHANGES
index babe9fc298..d7a68f1971 100644
--- a/CHANGES
+++ b/CHANGES
@@ -16,6 +16,13 @@
 			in the dispatch code to avoid retrying with the
 			same server. [GL #4005]<
 
+6152.	[bug]		In dispatch, honour the configured source-port
+			selection when UDP connection fails with address
+			in use error.
+
+			Also treat ISC_R_NOPERM same as ISC_R_ADDRINUSE.
+			[GL #3986]
+
 6149.	[test]		As a workaround, include an OpenSSL header file before
 			including cmocka.h in the unit tests, because OpenSSL
 			3.1.0 uses __attribute__(malloc), conflicting with a
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index b529a4ae8f..dcc0cbb496 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -1422,7 +1422,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
 		 dns_dispentry_t **respp) {
 	dns_dispentry_t *resp = NULL;
 	dns_qid_t *qid = NULL;
-	in_port_t dispport, localport = 0;
+	in_port_t localport;
 	dns_messageid_t id;
 	unsigned int bucket;
 	bool ok = false;
@@ -1447,10 +1447,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
 
 	qid = disp->mgr->qid;
 
-	dispport = isc_sockaddr_getport(&disp->local);
-	if (dispport != 0) {
-		localport = dispport;
-	}
+	localport = isc_sockaddr_getport(&disp->local);
 
 	resp = isc_mem_get(disp->mgr->mctx, sizeof(*resp));
 	*resp = (dns_dispentry_t){
@@ -1921,8 +1918,9 @@ udp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 		resp->state = DNS_DISPATCHSTATE_CONNECTED;
 		udp_startrecv(handle, resp);
 		break;
+	case ISC_R_NOPERM:
 	case ISC_R_ADDRINUSE: {
-		in_port_t localport = 0;
+		in_port_t localport = isc_sockaddr_getport(&disp->local);
 		isc_result_t result;
 
 		/* probably a port collision; try a different one */