diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
index 26e8f910e..ba8feff15 100644
--- a/include/openssl/ssl.h
+++ b/include/openssl/ssl.h
@@ -157,11 +157,6 @@
 #include <sys/time.h>
 #endif
 
-// NGINX needs this #include. Consider revisiting this after NGINX 1.14.0 has
-// been out for a year or so (assuming that they fix it in that release.) See
-// https://boringssl-review.googlesource.com/c/boringssl/+/21664.
-#include <openssl/hmac.h>
-
 // Forward-declare struct timeval. On Windows, it is defined in winsock2.h and
 // Windows headers define too many macros to be included in public headers.
 // However, only a forward declaration is needed.
diff --git a/ssl/test/test_config.cc b/ssl/test/test_config.cc
index b887478c9..850cb23fb 100644
--- a/ssl/test/test_config.cc
+++ b/ssl/test/test_config.cc
@@ -28,6 +28,7 @@
 #include <type_traits>
 
 #include <openssl/base64.h>
+#include <openssl/hmac.h>
 #include <openssl/hpke.h>
 #include <openssl/rand.h>
 #include <openssl/span.h>