diff --git a/doc/Changelog b/doc/Changelog
index 2815ab010..2d2e5bc28 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+2 May 2012: Wouter
+	- Fix validation of nodata for DS query in NSEC zones, reported by
+	  Ondrej Mikle.
+
 13 April 2012: Wouter
 	- ECDSA support (RFC 6605) by default. Use --disable-ecdsa for older
 	  openssl.
diff --git a/validator/val_nsec.c b/validator/val_nsec.c
index 640687019..8bda8dabc 100644
--- a/validator/val_nsec.c
+++ b/validator/val_nsec.c
@@ -368,8 +368,8 @@ int nsec_proves_nodata(struct ub_packed_rrset_key* nsec,
 		!nsec_has_type(nsec, LDNS_RR_TYPE_SOA)) {
 		return 0;
 	} else if(qinfo->qtype == LDNS_RR_TYPE_DS &&
-		nsec_has_type(nsec, LDNS_RR_TYPE_SOA &&
-		!dname_is_root(qinfo->qname))) {
+		nsec_has_type(nsec, LDNS_RR_TYPE_SOA) &&
+		!dname_is_root(qinfo->qname)) {
 		return 0;
 	}