diff --git a/CHANGES b/CHANGES
index 72b9242f..c98b6f83 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,10 @@
+09 May 2008 - trunk
+-------------------
+
+* Force modules "mod_rpaf-2.0.c" and "mod_custom_header.c" to run before
+  ModSecurity so that the correct IP is used.
+
+
 07 May 2008 - 2.5.4
 -------------------
 
diff --git a/apache2/mod_security2.c b/apache2/mod_security2.c
index ed9fbf41..c26e37c0 100644
--- a/apache2/mod_security2.c
+++ b/apache2/mod_security2.c
@@ -1057,7 +1057,9 @@ static void register_hooks(apr_pool_t *mp) {
     };
     static const char *postread_beforeme_list[] = {
         "mod_rpaf.c",
+        "mod_rpaf-2.0.c",
         "mod_extract_forwarded2.c",
+        "mod_custom_header.c",
         "mod_breach_realip.c",
         "mod_breach_trans.c",
         "mod_unique_id.c",