diff --git a/src/plugins/preauth/otp/main.c b/src/plugins/preauth/otp/main.c
index bf9c6a89f6f..7941b4aeeef 100644
--- a/src/plugins/preauth/otp/main.c
+++ b/src/plugins/preauth/otp/main.c
@@ -42,6 +42,7 @@ static krb5_preauthtype otp_pa_type_list[] =
 struct request_state {
     krb5_kdcpreauth_verify_respond_fn respond;
     void *arg;
+    krb5_enc_tkt_part *enc_tkt_reply;
 };
 
 static krb5_error_code
@@ -159,6 +160,9 @@ on_response(void *data, krb5_error_code retval, otp_response response)
     if (retval == 0 && response != otp_response_success)
         retval = KRB5_PREAUTH_FAILED;
 
+    if (retval == 0)
+        rs.enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH;
+
     rs.respond(rs.arg, retval, NULL, NULL, NULL);
 }
 
@@ -263,8 +267,6 @@ otp_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request,
     krb5_data d, plaintext;
     char *config;
 
-    enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH;
-
     /* Get the FAST armor key. */
     armor_key = cb->fast_armor(context, rock);
     if (armor_key == NULL) {
@@ -298,12 +300,14 @@ otp_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request,
         goto error;
     }
 
-    /* Create the request state. */
+    /* Create the request state.  Save the response callback, and the
+     * enc_tkt_reply pointer so we can set the TKT_FLG_PRE_AUTH flag later. */
     rs = k5alloc(sizeof(struct request_state), &retval);
     if (rs == NULL)
         goto error;
     rs->arg = arg;
     rs->respond = respond;
+    rs->enc_tkt_reply = enc_tkt_reply;
 
     /* Get the principal's OTP configuration string. */
     retval = cb->get_string(context, rock, "otp", &config);
diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
index b4727412936..5b1d73e4a6c 100644
--- a/src/plugins/preauth/pkinit/pkinit_srv.c
+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
@@ -301,7 +301,7 @@ pkinit_server_verify_padata(krb5_context context,
 
     pkiDebug("pkinit_verify_padata: entered!\n");
     if (data == NULL || data->length <= 0 || data->contents == NULL) {
-        (*respond)(arg, 0, NULL, NULL, NULL);
+        (*respond)(arg, EINVAL, NULL, NULL, NULL);
         return;
     }
 
@@ -313,7 +313,7 @@ pkinit_server_verify_padata(krb5_context context,
 
     plgctx = pkinit_find_realm_context(context, moddata, request->server);
     if (plgctx == NULL) {
-        (*respond)(arg, 0, NULL, NULL, NULL);
+        (*respond)(arg, EINVAL, NULL, NULL, NULL);
         return;
     }