diff --git a/selftest/knownfail.d/kinit_mit b/selftest/knownfail_mit_krb5_pre_1_18
similarity index 100%
rename from selftest/knownfail.d/kinit_mit
rename to selftest/knownfail_mit_krb5_pre_1_18
diff --git a/selftest/wscript b/selftest/wscript
index 4d03eb76842..501a5df5824 100644
--- a/selftest/wscript
+++ b/selftest/wscript
@@ -142,6 +142,9 @@ def cmd_testonly(opt):
                         '--flapping=${srcdir}/selftest/flapping '
                         '--flapping=${srcdir}/selftest/flapping.d')
 
+    if CONFIG_GET(opt, 'HAVE_MIT_KRB5_PRE_1_18'):
+        env.FILTER_XFAIL += ' --expected-failures=${srcdir}/selftest/knownfail_mit_krb5_pre_1_18'
+
     if Options.options.FAIL_IMMEDIATELY:
         env.FILTER_XFAIL += ' --fail-immediately'
 
diff --git a/testprogs/blackbox/test_kinit_mit.sh b/testprogs/blackbox/test_kinit_mit.sh
index d28caecd603..61029a5e04c 100755
--- a/testprogs/blackbox/test_kinit_mit.sh
+++ b/testprogs/blackbox/test_kinit_mit.sh
@@ -134,10 +134,6 @@ testit "enable user with kerberos cache" $VALGRIND $PYTHON $samba_enableaccount
 ### Test kinit with canonicalization
 ###########################################################
 
-# This is currently not working due to an upstream bug in MIT Kerberos. The
-# test will ensure that we get notified when we can turn on canonicalization
-# in ads_krb5_chg_password().
-# https://bugzilla.samba.org/show_bug.cgi?id=14155
 upperusername=$(echo $USERNAME | tr '[a-z]' '[A-Z]')
 testit "kinit with canonicalize" $samba_texpect $PREFIX/tmpkinitscript $samba_kinit -C $upperusername@$REALM -S kadmin/changepw@$REALM || failed=`expr $failed + 1`
 
diff --git a/wscript_configure_system_mitkrb5 b/wscript_configure_system_mitkrb5
index b14881f094c..b0bf2a8b40d 100644
--- a/wscript_configure_system_mitkrb5
+++ b/wscript_configure_system_mitkrb5
@@ -77,6 +77,9 @@ if conf.env.KRB5_CONFIG:
     else:
         Logs.info('MIT Kerberos %s detected, MIT krb5 build can proceed' % (krb5_version))
 
+    if parse_version(krb5_version) < parse_version('1.18'):
+        conf.DEFINE('HAVE_MIT_KRB5_PRE_1_18', 1)
+
 conf.CHECK_CFG(args="--cflags --libs", package="com_err", uselib_store="com_err")
 conf.CHECK_FUNCS_IN('_et_list', 'com_err')
 conf.CHECK_HEADERS('com_err.h', lib='com_err')