diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c
index e3bddf91203..fe9756da691 100644
--- a/src/interfaces/libpq/fe-auth.c
+++ b/src/interfaces/libpq/fe-auth.c
@@ -101,9 +101,9 @@ pg_GSS_continue(PGconn *conn, int payloadlen)
 	if (conn->Pfdebug)
 		pqTraceOutputMessage(conn, conn->inBuffer + conn->inStart, false);
 
-	/* Only try to acquire credentials if GSS delegation isn't disabled. */
-	if (!pg_GSS_have_cred_cache(&conn->gcred))
-		conn->gcred = GSS_C_NO_CREDENTIAL;
+	/* try to acquire credentials if we didn't already */
+	if (conn->gcred == GSS_C_NO_CREDENTIAL)
+		conn->gcred = pg_GSS_get_cred_cache();
 
 	if (conn->gssdelegation && conn->gssdelegation[0] == '1')
 		gss_flags |= GSS_C_DELEG_FLAG;
diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c
index 811cb0f2a50..9e17a8f1c6f 100644
--- a/src/interfaces/libpq/fe-connect.c
+++ b/src/interfaces/libpq/fe-connect.c
@@ -3281,7 +3281,8 @@ keep_going:						/* We will come back to here until there is
 						}
 						if (conn->gcred == GSS_C_NO_CREDENTIAL)
 						{
-							if (!pg_GSS_have_cred_cache(&conn->gcred))
+							conn->gcred = pg_GSS_get_cred_cache();
+							if (conn->gcred == GSS_C_NO_CREDENTIAL)
 							{
 								libpq_append_conn_error(conn,
 														"GSSAPI encryption required but no credential cache");
@@ -4847,15 +4848,16 @@ select_next_encryption_method(PGconn *conn, bool have_valid_connection)
 	if ((remaining_methods & ENC_GSSAPI) != 0)
 	{
 		/*
-		 * If GSSAPI encryption is enabled, then call pg_GSS_have_cred_cache()
-		 * which will return true if we can acquire credentials (and give us a
-		 * handle to use in conn->gcred), and then send a packet to the server
+		 * If GSSAPI encryption is enabled, then call pg_GSS_get_cred_cache()
+		 * to try to acquire credentials, and then send a packet to the server
 		 * asking for GSSAPI Encryption (and skip past SSL negotiation and
 		 * regular startup below).
 		 */
 		if (!conn->gctx)
 		{
-			if (!pg_GSS_have_cred_cache(&conn->gcred))
+			if (conn->gcred == GSS_C_NO_CREDENTIAL)
+				conn->gcred = pg_GSS_get_cred_cache();
+			if (conn->gcred == GSS_C_NO_CREDENTIAL)
 			{
 				conn->allowed_enc_methods &= ~ENC_GSSAPI;
 				remaining_methods &= ~ENC_GSSAPI;
@@ -5020,6 +5022,10 @@ pqMakeEmptyPGconn(void)
 	conn->altsock = PGINVALID_SOCKET;
 	conn->Pfdebug = NULL;
 
+#ifdef ENABLE_GSS
+	conn->gcred = GSS_C_NO_CREDENTIAL;	/* let's not assume this is 0 */
+#endif
+
 	/*
 	 * We try to send at least 8K at a time, which is the usual size of pipe
 	 * buffers on Unix systems.  That way, when we are sending a large amount
diff --git a/src/interfaces/libpq/fe-gssapi-common.c b/src/interfaces/libpq/fe-gssapi-common.c
index e7776fe76e7..c23819a219c 100644
--- a/src/interfaces/libpq/fe-gssapi-common.c
+++ b/src/interfaces/libpq/fe-gssapi-common.c
@@ -55,10 +55,11 @@ pg_GSS_error(const char *mprefix, PGconn *conn,
 }
 
 /*
- * Check if we can acquire credentials at all (and yield them if so).
+ * Attempt to acquire credentials, and return the token if successful.
+ * Return GSS_C_NO_CREDENTIAL if not.
  */
-bool
-pg_GSS_have_cred_cache(gss_cred_id_t *cred_out)
+gss_cred_id_t
+pg_GSS_get_cred_cache(void)
 {
 	OM_uint32	major,
 				minor;
@@ -67,12 +68,8 @@ pg_GSS_have_cred_cache(gss_cred_id_t *cred_out)
 	major = gss_acquire_cred(&minor, GSS_C_NO_NAME, 0, GSS_C_NO_OID_SET,
 							 GSS_C_INITIATE, &cred, NULL, NULL);
 	if (major != GSS_S_COMPLETE)
-	{
-		*cred_out = NULL;
-		return false;
-	}
-	*cred_out = cred;
-	return true;
+		return GSS_C_NO_CREDENTIAL;
+	return cred;
 }
 
 /*
diff --git a/src/interfaces/libpq/fe-gssapi-common.h b/src/interfaces/libpq/fe-gssapi-common.h
index f89d9e071e8..769e9f5ae91 100644
--- a/src/interfaces/libpq/fe-gssapi-common.h
+++ b/src/interfaces/libpq/fe-gssapi-common.h
@@ -20,7 +20,7 @@
 
 void		pg_GSS_error(const char *mprefix, PGconn *conn,
 						 OM_uint32 maj_stat, OM_uint32 min_stat);
-bool		pg_GSS_have_cred_cache(gss_cred_id_t *cred_out);
+gss_cred_id_t pg_GSS_get_cred_cache(void);
 int			pg_GSS_load_servicename(PGconn *conn);
 
 #endif
diff --git a/src/interfaces/libpq/fe-secure-gssapi.c b/src/interfaces/libpq/fe-secure-gssapi.c
index 5ae10af5678..c43ab0294df 100644
--- a/src/interfaces/libpq/fe-secure-gssapi.c
+++ b/src/interfaces/libpq/fe-secure-gssapi.c
@@ -640,9 +640,9 @@ pqsecure_open_gss(PGconn *conn)
 
 	if (conn->gssdelegation && conn->gssdelegation[0] == '1')
 	{
-		/* Acquire credentials if possible */
+		/* Attempt to acquire credentials, if we didn't already */
 		if (conn->gcred == GSS_C_NO_CREDENTIAL)
-			(void) pg_GSS_have_cred_cache(&conn->gcred);
+			conn->gcred = pg_GSS_get_cred_cache();
 
 		/*
 		 * We have credentials and gssdelegation is enabled, so request