diff --git a/sshprime.c b/sshprime.c
index 45081ed3..44ab386e 100644
--- a/sshprime.c
+++ b/sshprime.c
@@ -194,10 +194,12 @@ mp_int *primegen(
      * random number with the top bit set and the bottom bit clear,
      * multiply it by `factor', and add one.
      */
-    mp_int *p = mp_random_bits(bits - 1);
+    mp_int *p = mp_power_2(bits - 1);  /* ensure top bit is 1 */
+    mp_int *r = mp_random_bits(bits - 1);
+    mp_or_into(p, p, r);
+    mp_free(r);
+    mp_set_bit(p, 0, factor ? 0 : 1);  /* set bottom bit appropriately */
 
-    mp_set_bit(p, 0, factor ? 0 : 1);  /* bottom bit */
-    mp_set_bit(p, bits-1, 1);          /* top bit */
     for (size_t i = 0; i < fbsize; i++)
         mp_set_bit(p, bits-fbsize + i, 1 & (firstbits >> i));
 
diff --git a/sshrsag.c b/sshrsag.c
index d70ac6b4..2d88fef9 100644
--- a/sshrsag.c
+++ b/sshrsag.c
@@ -71,15 +71,26 @@ int rsa_generate(RSAKey *key, int bits, progfn_t pfn,
      * but it doesn't cost much to make sure.)
      */
     invent_firstbits(&pfirst, &qfirst, 2);
-    mp_int *p = primegen(bits / 2, RSA_EXPONENT, 1, NULL,
-                            1, pfn, pfnparam, pfirst);
-    mp_int *q = primegen(bits - bits / 2, RSA_EXPONENT, 1, NULL,
-                            2, pfn, pfnparam, qfirst);
+    int qbits = bits / 2;
+    int pbits = bits - qbits;
+    assert(pbits >= qbits);
+    mp_int *p = primegen(pbits, RSA_EXPONENT, 1, NULL,
+                         1, pfn, pfnparam, pfirst);
+    mp_int *q = primegen(qbits, RSA_EXPONENT, 1, NULL,
+                         2, pfn, pfnparam, qfirst);
 
     /*
      * Ensure p > q, by swapping them if not.
+     *
+     * We only need to do this if the two primes were generated with
+     * the same number of bits (i.e. if the requested key size is
+     * even) - otherwise it's already guaranteed!
      */
-    mp_cond_swap(p, q, mp_cmp_hs(q, p));
+    if (pbits == qbits) {
+        mp_cond_swap(p, q, mp_cmp_hs(q, p));
+    } else {
+        assert(mp_cmp_hs(p, q));
+    }
 
     /*
      * Now we have p, q and e. All we need to do now is work out