diff --git a/lib/resolve.c b/lib/resolve.c
index 99343d5dc138a88cd1a31bce609b311d65b42e6c..976a9517a620a49be572125996c709c8a1bd2f8d 100644
--- a/lib/resolve.c
+++ b/lib/resolve.c
@@ -397,11 +397,6 @@ static int answer_finalize(struct kr_request *request, int state)
 
 static int query_finalize(struct kr_request *request, struct kr_query *qry, knot_pkt_t *pkt)
 {
-	/* Randomize query case (if not in safemode) */
-	qry->secret = (qry->flags & QUERY_SAFEMODE) ? 0 : kr_rand_uint(UINT32_MAX);
-	knot_dname_t *qname_raw = (knot_dname_t *)knot_pkt_qname(pkt);
-	randomized_qname_case(qname_raw, qry->secret);
-
 	int ret = 0;
 	knot_pkt_begin(pkt, KNOT_ADDITIONAL);
 	if (!(qry->flags & QUERY_SAFEMODE)) {
@@ -831,6 +826,11 @@ int kr_resolve_produce(struct kr_request *request, struct sockaddr **dst, int *t
 		return KNOT_STATE_PRODUCE;
 	}
 
+	/* Randomize query case (if not in safemode) */
+	qry->secret = (qry->flags & QUERY_SAFEMODE) ? 0 : kr_rand_uint(UINT32_MAX);
+	knot_dname_t *qname_raw = (knot_dname_t *)knot_pkt_qname(packet);
+	randomized_qname_case(qname_raw, qry->secret);
+
 	/*
 	 * Additional query is going to be finalised when calling
 	 * kr_resolve_checkout().