diff --git a/NEWS b/NEWS
index 73b393159e846442506d613746b3f3cf73a50d51..b9875f69a8e64c1e7be604ffa8984bf56f78654c 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,11 @@ release/005.005 (unreleased)
     unless specifically overridden to false Kerberos
     clients will behave as they always have. [adamhl]
 
+    [kerberos] Chnage the master_kdc setting in krb5.conf to point to an
+    alias of the master (kerberos1). This will have not change how the
+    configuration works, but makes it easier to change the ordering of the
+    replicas if, in the future, we need to.
+
 release/005.004 (2017-01-09)
 
     [os] Change the exec resource in the 'aptitude' staged
diff --git a/templates/kerberos/krb5.conf.erb b/templates/kerberos/krb5.conf.erb
index f0494cf1aada8abb9a8775fd1620ae8e6350fc88..808b995aa3245d5c459df4442cc6a30be9916286 100644
--- a/templates/kerberos/krb5.conf.erb
+++ b/templates/kerberos/krb5.conf.erb
@@ -86,7 +86,7 @@ else
         kdc            = krb5auth1.stanford.edu:88
         kdc            = krb5auth2.stanford.edu:88
         kdc            = krb5auth3.stanford.edu:88
-        master_kdc     = krb5auth1.stanford.edu:88
+        master_kdc     = master-kdc.stanford.edu:88
         admin_server   = krb5-admin.stanford.edu
         kpasswd_server = krb5-admin.stanford.edu
 <%