diff --git a/config.h.in b/config.h.in
index f0eb7d6aa..7c3309683 100644
--- a/config.h.in
+++ b/config.h.in
@@ -966,7 +966,9 @@
 
 
 #ifndef UNBOUND_DEBUG
+# ifndef NDEBUG
 #  define NDEBUG
+# endif
 #endif
 
 /** Use small-ldns codebase */
diff --git a/configure.ac b/configure.ac
index ff6f05ad7..8393e152a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1652,7 +1652,9 @@ AHX_CONFIG_EXT_FLAGS
 dnl includes
 [
 #ifndef UNBOUND_DEBUG
+# ifndef NDEBUG
 #  define NDEBUG
+# endif
 #endif
 
 /** Use small-ldns codebase */
diff --git a/doc/Changelog b/doc/Changelog
index 4bb341653..43db79466 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+7 March 2019: Wouter
+	- Fix for #4233: guard use of NDEBUG, so that it can be passed in
+	  CFLAGS into configure.
+
 5 March 2019: Wouter
 	- Tag release 1.9.1rc1.