diff --git a/src/crypto/hcrypto/kernel/roken.h b/src/crypto/hcrypto/kernel/roken.h
index e69de29bb2..f8c2334685 100644
--- a/src/crypto/hcrypto/kernel/roken.h
+++ b/src/crypto/hcrypto/kernel/roken.h
@@ -0,0 +1,17 @@
+#ifndef OPENAFS_HCRYPTO_KERNEL_ROKEN_H
+#define OPENAFS_HCRYPTO_KERNEL_ROKEN_H
+
+/*
+ * This is a stub roken.h used for building roken code (or roken-using code) in
+ * the kernel. For userspace code, use a real roken.h. This just contains a few
+ * prototypes of roken functions we actually use in kernel code.
+ */
+
+#ifndef KERNEL
+# error "This header is for kernel code only"
+#endif
+
+/* ct.c */
+int ct_memcmp(const void *p1, const void *p2, size_t len);
+
+#endif /* OPENAFS_HCRYPTO_KERNEL_ROKEN_H */
diff --git a/src/crypto/rfc3961/krb5_locl.h b/src/crypto/rfc3961/krb5_locl.h
index eb279a95ff..6e706737c5 100644
--- a/src/crypto/rfc3961/krb5_locl.h
+++ b/src/crypto/rfc3961/krb5_locl.h
@@ -5,6 +5,7 @@
 #ifdef KERNEL
 
 #include "config.h"
+#include <roken.h>
 
 #else
 #include <afsconfig.h>
@@ -285,11 +286,6 @@ int copy_EncryptionKey(const krb5_keyblock *, krb5_keyblock *);
 krb5_error_code krb5_enctype_to_string(krb5_context context,
 				       krb5_enctype etype,
 				       char **string);
-#ifdef KERNEL
-/* Roken provides this in userspace, but we're on our own in the kernel. */
-int ct_memcmp(const void *p1, const void *p2, size_t len);
-#endif
-
 
 #include "crypto.h"