diff --git a/Correct-kpasswd_server-description-in-krb5.conf-5.patch b/Correct-kpasswd_server-description-in-krb5.conf-5.patch
new file mode 100644
index 0000000..07e10d1
--- /dev/null
+++ b/Correct-kpasswd_server-description-in-krb5.conf-5.patch
@@ -0,0 +1,28 @@
+From c5d97d45431509fe972ce24fed2429027221b0ec Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Tue, 16 Oct 2018 17:32:29 -0400
+Subject: [PATCH] Correct kpasswd_server description in krb5.conf(5)
+
+ticket: 8754 (new)
+tags: pullup
+target_version: 1.16-next
+
+(cherry picked from commit 762d804701f78fc76f728ec05a205eea6a2b2dd7)
+---
+ doc/admin/conf_files/krb5_conf.rst | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index eb5c29e5d..f5139244b 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -523,7 +523,8 @@ following tags may be specified in the realm's subsection:
+ 
+ **kpasswd_server**
+     Points to the server where all the password changes are performed.
+-    If there is no such entry, the port 464 on the **admin_server**
++    If there is no such entry, DNS will be queried (unless forbidden
++    by **dns_lookup_kdc**).  Finally, port 464 on the **admin_server**
+     host will be tried.
+ 
+ **master_kdc**
diff --git a/krb5.spec b/krb5.spec
index 0de5b73..4aea62d 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.16.1
 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces)
-Release: 22%{?dist}
+Release: 23%{?dist}
 
 # lookaside-cached sources; two downloads and a build artifact
 Source0: https://web.mit.edu/kerberos/dist/krb5/1.16/krb5-%{version}%{prerelease}.tar.gz
@@ -104,6 +104,7 @@ Patch84: Remove-outdated-note-in-krb5kdc-man-page.patch
 Patch85: Fix-k5test-prompts-for-Python-3.patch
 Patch86: In-FIPS-mode-add-plaintext-fallback-for-RC4-usages-a.patch
 Patch87: Prefer-TCP-to-UDP-for-password-changes.patch
+Patch88: Correct-kpasswd_server-description-in-krb5.conf-5.patch
 
 License: MIT
 URL: http://web.mit.edu/kerberos/www/
@@ -750,6 +751,10 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Wed Oct 17 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-23
+- Correct kpasswd_server description in krb5.conf(5)
+- Resolves: #1640272
+
 * Mon Oct 15 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-22
 - Prefer TCP to UDP for password changes
 - Resolves: #1637611