diff --git a/configure.ac b/configure.ac
index 64426745f1..c8c2895518 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1289,6 +1289,13 @@ if test "x$with_gnutls" != "xno"; then
     with_gnutls=yes
   fi
 
+  dnl GNUTLS_CFLAGS and GNUTLS_LIBS have probably been updated above,
+  dnl and we need the final values for function probing to work
+  CFLAGS="$old_CFLAGS $GNUTLS_CFLAGS"
+  LIBS="$old_LIBS $GNUTLS_LIBS"
+
+  AC_CHECK_FUNCS([gnutls_rnd])
+
   CFLAGS="$old_CFLAGS"
   LIBS="$old_LIBS"
 fi
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index fa7cfc9d86..55dcba8b94 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -635,8 +635,8 @@ qemuDomainGenerateRandomKey(size_t nbytes)
     if (VIR_ALLOC_N(key, nbytes) < 0)
         return NULL;
 
-#if HAVE_GNUTLS_CRYPTO_H
-    /* Generate a master key using gnutls if possible */
+#if HAVE_GNUTLS_RND
+    /* Generate a master key using gnutls_rnd() if possible */
     if ((ret = gnutls_rnd(GNUTLS_RND_RANDOM, key, nbytes)) < 0) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
                        _("failed to generate master key, ret=%d"), ret);
@@ -644,7 +644,7 @@ qemuDomainGenerateRandomKey(size_t nbytes)
         return NULL;
     }
 #else
-    /* If we don't have gnutls, we will generate a less cryptographically
+    /* If we don't have gnutls_rnd(), we will generate a less cryptographically
      * strong master key from /dev/urandom.
      */
     if ((ret = virRandomBytes(key, nbytes)) < 0) {