diff --git a/src/etc/rc b/src/etc/rc
index ad1d5870..b0c08f4f 100644
--- a/src/etc/rc
+++ b/src/etc/rc
@@ -1,4 +1,4 @@
-#	$OpenBSD: rc,v 1.145 2000/07/06 13:24:49 itojun Exp $
+#	$OpenBSD: rc,v 1.146 2000/07/11 22:30:56 matt Exp $
 
 # System startup script run by init on autoboot
 # or after single-user.
@@ -252,6 +252,11 @@ if [ X${amd} = X"YES" -a -d ${amd_dir} -a -e ${amd_master} ]; then
 	    -a ${amd_dir} `cat ${amd_master}` > /var/run/amd.pid )
 fi
 
+# run rdate before timed
+if [ $securelevel -le 1 -a X"${rdate_flags}" != X"NO" ]; then
+        echo -n ' rdate';     rdate -s ${rdate_flags}
+fi
+
 # $timed_flags is imported from /etc/rc.conf;
 # if $timed_flags == NO, timed isn't run.
 if [ "X${timed_flags}" != X"NO" ]; then
diff --git a/src/etc/rc.conf b/src/etc/rc.conf
index dbded1ea..bb3e95ac 100644
--- a/src/etc/rc.conf
+++ b/src/etc/rc.conf
@@ -1,6 +1,6 @@
 #!/bin/sh -
 #
-#	$OpenBSD: rc.conf,v 1.50 2000/07/06 13:24:49 itojun Exp $
+#	$OpenBSD: rc.conf,v 1.51 2000/07/11 22:30:56 matt Exp $
 
 # set these to "NO" to turn them off.  otherwise, they're used as flags
 routed_flags=NO		# for normal use: "-q"
@@ -12,7 +12,9 @@ rbootd_flags=NO		# for normal use: ""
 sendmail_flags="-q30m"	# for normal use: "-bd -q30m"
 smtpfwdd_flags=NO	# for normal use: "", and no "-bd" above.
 named_flags=NO		# for normal use: ""
+rdate_flags=NO		# for normal use: name of RFC868 timeserver
 timed_flags=NO		# for normal use: ""
+ntpdate_flags=NO	# for normal use: NTP server; run before ntpd starts
 photurisd_flags=NO	# for normal use: ""
 isakmpd_flags=NO	# for normal use: ""
 mopd_flags=NO		# for normal use: "-a"
diff --git a/src/etc/rc.local b/src/etc/rc.local
index bd26113b..9b12a44b 100644
--- a/src/etc/rc.local
+++ b/src/etc/rc.local
@@ -1,4 +1,4 @@
-#	$OpenBSD: rc.local,v 1.29 2000/06/24 19:37:33 jakob Exp $
+#	$OpenBSD: rc.local,v 1.30 2000/07/11 22:30:56 matt Exp $
 
 # site-specific startup actions, daemons, and other things which
 # can be done AFTER your system goes into securemode.  For actions
@@ -10,6 +10,18 @@
 
 echo -n 'starting local daemons:'
 
+# run ntpdate prior to ntpd
+if [ $securelevel -le 1 -a X"${ntpdate_flags}" != X"NO" \
+    -a -x /usr/local/sbin/ntpdate ]; then
+	echo -n ' ntpdate'
+	/usr/local/sbin/ntpdate -b ${ntpdate_flags} >/dev/null
+fi
+
+if [ X"${ntpd}" == X"YES" -a -x /usr/local/sbin/ntpd \
+    -a -e /etc/ntp.conf ]; then
+       echo -n ' ntpd';       /usr/local/sbin/ntpd -p /var/run/ntpd.pid
+fi
+
 if [ -x /usr/local/sbin/cfsd ]; then
 	if ps auxc | grep -q '^ *root .* mountd$'; then
 		echo -n ' cfsd';        /usr/local/sbin/cfsd >/dev/null 2>&1
diff --git a/src/etc/rc.securelevel b/src/etc/rc.securelevel
index b527f627..04737b3c 100644
--- a/src/etc/rc.securelevel
+++ b/src/etc/rc.securelevel
@@ -1,4 +1,4 @@
-#	$OpenBSD: rc.securelevel,v 1.12 2000/03/29 17:34:56 mickey Exp $
+#	$OpenBSD: rc.securelevel,v 1.13 2000/07/11 22:30:56 matt Exp $
 #
 # site-specific startup actions, daemons, and other things which
 # can be done BEFORE your system goes into securemode.  For actions
@@ -15,12 +15,19 @@ securelevel=1
 
 echo -n 'starting pre-securelevel daemons:'
 
-# Former ntpd versions was called xntpd, change the ntpd references below
-# to xntpd if you run such a version.
-if [ X"${ntpd}" == X"YES" -a -x /usr/local/sbin/ntpd \
+# Securelevel > 1 does not allow the clock to be set backwards
+if [ $securelevel -gt 1 ]; then
+	if [ X"${ntpdate_flags}" != X"NO" -a -x /usr/local/sbin/ntpdate ]; then
+		echo -n ' ntpdate'
+		/usr/local/sbin/ntpdate -b ${ntpdate_flags} >/dev/null
+	elif [ X"${rdate_flags}" != X"NO" ]; then
+		echo -n ' rdate';	rdate -s ${rdate_flags}
+	fi
+fi
+
+if [ X"${ntpd}" == X"YES" -a -x /usr/local/sbin/tickadj \
     -a -e /etc/ntp.conf ]; then
-       /usr/local/sbin/tickadj -Aq
-       echo -n ' ntpd';       /usr/local/sbin/ntpd -p /var/run/ntpd.pid
+       echo -n ' tickadj';	/usr/local/sbin/tickadj -Aq
 fi
 
 echo '.'