4 files changed, 45 insertions, 23 deletions
diff --git a/src/include/libpq/be-gssapi-common.h b/src/include/libpq/be-gssapi-common.h
index 72f05748b6d..bfe8d7656ed 100644
--- a/src/include/libpq/be-gssapi-common.h
+++ b/src/include/libpq/be-gssapi-common.h
@@ -16,13 +16,7 @@
 
 #ifdef ENABLE_GSS
 
-#if defined(HAVE_GSSAPI_H)
-#include <gssapi.h>
-#include <gssapi_ext.h>
-#else
-#include <gssapi/gssapi.h>
-#include <gssapi/gssapi_ext.h>
-#endif
+#include "libpq/pg-gssapi.h"
 
 extern void pg_GSS_error(const char *errmsg,
 						 OM_uint32 maj_stat, OM_uint32 min_stat);
diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h
index 7fe92b15477..0d1f1838f73 100644
--- a/src/include/libpq/libpq-be.h
+++ b/src/include/libpq/libpq-be.h
@@ -27,13 +27,7 @@
 #endif
 #include <netinet/tcp.h>
 
-#ifdef ENABLE_GSS
-#if defined(HAVE_GSSAPI_H)
-#include <gssapi.h>
-#else
-#include <gssapi/gssapi.h>
-#endif							/* HAVE_GSSAPI_H */
-#endif							/* ENABLE_GSS */
+#include "libpq/pg-gssapi.h"
 
 #ifdef ENABLE_SSPI
 #define SECURITY_WIN32
diff --git a/src/include/libpq/pg-gssapi.h b/src/include/libpq/pg-gssapi.h
new file mode 100644
index 00000000000..f49fad14fcc
--- /dev/null
+++ b/src/include/libpq/pg-gssapi.h
@@ -0,0 +1,42 @@
+/*-------------------------------------------------------------------------
+ *
+ * pg-gssapi.h
+ *       Definitions for including GSSAPI headers
+ *
+ * Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * src/include/libpq/pg-gssapi.h
+ *
+ *-------------------------------------------------------------------------
+ */
+
+#ifndef PG_GSSAPI_H
+#define PG_GSSAPI_H
+
+#ifdef ENABLE_GSS
+
+/* IWYU pragma: begin_exports */
+#if defined(HAVE_GSSAPI_H)
+#include <gssapi.h>
+#include <gssapi_ext.h>
+#else
+#include <gssapi/gssapi.h>
+#include <gssapi/gssapi_ext.h>
+#endif
+/* IWYU pragma: end_exports */
+
+/*
+* On Windows, <wincrypt.h> includes a #define for X509_NAME, which breaks our
+* ability to use OpenSSL's version of that symbol if <wincrypt.h> is pulled
+* in after <openssl/ssl.h> ... and, at least on some builds, it is.  We
+* can't reliably fix that by re-ordering #includes, because libpq/libpq-be.h
+* #includes <openssl/ssl.h>.  Instead, just zap the #define again here.
+*/
+#ifdef X509_NAME
+#undef X509_NAME
+#endif
+
+#endif							/* ENABLE_GSS */
+
+#endif							/* PG_GSSAPI_H */
diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h
index f36f7f19d58..ade5ad82f07 100644
--- a/src/interfaces/libpq/libpq-int.h
+++ b/src/interfaces/libpq/libpq-int.h
@@ -44,15 +44,7 @@
 #include "fe-auth-sasl.h"
 #include "pqexpbuffer.h"
 
-/* IWYU pragma: begin_exports */
-#ifdef ENABLE_GSS
-#if defined(HAVE_GSSAPI_H)
-#include <gssapi.h>
-#else
-#include <gssapi/gssapi.h>
-#endif
-#endif
-/* IWYU pragma: end_exports */
+#include "libpq/pg-gssapi.h"
 
 #ifdef ENABLE_SSPI
 #define SECURITY_WIN32