diff --git a/ChangeLog b/ChangeLog
index 04c919858..bbf853687 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,9 @@
    zlib >= 1.1.4.  Partly from jbasney at ncsa.uiuc.edu.  ok djm@
  - (dtucker) [contrib/cygwin/README] Document new ssh-host-config options.
    Patch from vinschen at redhat.com.
+ - (dtucker) [acconfig.h configure.ac includes.h servconf.c session.c]
+   Change AFS symbol to USE_AFS to prevent namespace collisions, do not
+   include kafs.h unless necessary.  From deengert at anl.gov.
 
 20040122
  - (dtucker) [configure.ac] Use krb5-config where available for Kerberos/
@@ -1720,4 +1723,4 @@
  - Fix sshd BindAddress and -b options for systems using fake-getaddrinfo.
    Report from murple@murple.net, diagnosis from dtucker@zip.com.au
 
-$Id: ChangeLog,v 1.3184 2004/01/23 10:35:44 dtucker Exp $
+$Id: ChangeLog,v 1.3185 2004/01/23 11:03:10 dtucker Exp $
diff --git a/acconfig.h b/acconfig.h
index 40162b731..27366ed17 100644
--- a/acconfig.h
+++ b/acconfig.h
@@ -1,4 +1,4 @@
-/* $Id: acconfig.h,v 1.171 2004/01/05 11:36:52 dtucker Exp $ */
+/* $Id: acconfig.h,v 1.172 2004/01/23 11:03:10 dtucker Exp $ */
 
 /*
  * Copyright (c) 1999-2003 Damien Miller.  All rights reserved.
@@ -256,8 +256,8 @@
 /* Define this if you are using the Heimdal version of Kerberos V5 */
 #undef HEIMDAL
 
-/* Define this if you want to use Heimdal's AFS support */
-#undef AFS
+/* Define this if you want to use libkafs' AFS support */
+#undef USE_AFS
 
 /* Define if you want S/Key support */
 #undef SKEY
diff --git a/configure.ac b/configure.ac
index c98332ac2..b5fc7ace0 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.186 2004/01/23 06:13:33 dtucker Exp $
+# $Id: configure.ac,v 1.187 2004/01/23 11:03:10 dtucker Exp $
 
 AC_INIT
 AC_CONFIG_SRCDIR([ssh.c])
@@ -2128,7 +2128,7 @@ AC_ARG_WITH(kerberos5,
 		fi
 	fi ]
 	AC_SEARCH_LIBS(k_hasafs, kafs,
-		[ AC_DEFINE(AFS)
+		[ AC_DEFINE(USE_AFS)
 		  K5LIBS="-lkafs $K5LIBS"
 		]
 	)
diff --git a/includes.h b/includes.h
index 02364bbd7..764bd57fe 100644
--- a/includes.h
+++ b/includes.h
@@ -169,7 +169,7 @@ static /**/const char *const rcsid[] = { (char *)rcsid, "\100(#)" msg }
 # include <libutil.h> /* Openpty on FreeBSD at least */
 #endif
 
-#if defined(HEIMDAL) && defined(AFS)
+#if defined(KRB5) && defined(USE_AFS)
 # include <krb5.h>
 # include <kafs.h>
 #endif
diff --git a/servconf.c b/servconf.c
index 04a10fadf..a72246b6c 100644
--- a/servconf.c
+++ b/servconf.c
@@ -305,7 +305,7 @@ static struct {
 	{ "kerberosauthentication", sKerberosAuthentication },
 	{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd },
 	{ "kerberosticketcleanup", sKerberosTicketCleanup },
-#ifdef AFS
+#ifdef USE_AFS
 	{ "kerberosgetafstoken", sKerberosGetAFSToken },
 #else
 	{ "kerberosgetafstoken", sUnsupported },
diff --git a/session.c b/session.c
index 947ba5eff..3a6d1a028 100644
--- a/session.c
+++ b/session.c
@@ -58,7 +58,7 @@ RCSID("$OpenBSD: session.c,v 1.171 2004/01/13 19:23:15 markus Exp $");
 #include "session.h"
 #include "monitor_wrap.h"
 
-#ifdef KRB5
+#if defined(KRB5) && defined(USE_AFS)
 #include <kafs.h>
 #endif
 
@@ -1425,7 +1425,7 @@ do_child(Session *s, const char *command)
 	 */
 	environ = env;
 
-#if defined(KRB5) && defined(AFS)
+#if defined(KRB5) && defined(USE_AFS)
 	/*
 	 * At this point, we check to see if AFS is active and if we have
 	 * a valid Kerberos 5 TGT. If so, it seems like a good idea to see