diff --git a/certinject/certinject.go b/certinject/certinject.go
index c4da3be..28ce0f8 100644
--- a/certinject/certinject.go
+++ b/certinject/certinject.go
@@ -1,9 +1,12 @@
 package certinject
 
 import (
+	"github.com/hlandau/xlog"
 	"gopkg.in/hlandau/easyconfig.v1/cflag"
 )
 
+var log, Log = xlog.New("ncdns.certinject")
+
 var (
 	flagGroup        = cflag.NewGroup(nil, "certstore")
 	nssFlag          = cflag.Bool(flagGroup, "nss", false, nssExplain)
diff --git a/certinject/certinject_notwindows.go b/certinject/certinject_notwindows.go
index ee70a3e..5439eaa 100644
--- a/certinject/certinject_notwindows.go
+++ b/certinject/certinject_notwindows.go
@@ -2,14 +2,10 @@
 
 package certinject
 
-import "github.com/hlandau/xlog"
-
 // This package is used to add and remove certificates to the system trust
 // store.
 // Currently only supports NSS sqlite3 stores.
 
-var log, Log = xlog.New("ncdns.certinject")
-
 // InjectCert injects the given cert into all configured trust stores.
 func InjectCert(derBytes []byte) {
 
diff --git a/certinject/certinject_windows.go b/certinject/certinject_windows.go
index 2670ff6..279d720 100644
--- a/certinject/certinject_windows.go
+++ b/certinject/certinject_windows.go
@@ -1,7 +1,6 @@
 package certinject
 
 import (
-	"github.com/hlandau/xlog"
 	"gopkg.in/hlandau/easyconfig.v1/cflag"
 )
 
@@ -9,8 +8,6 @@ import (
 // store.
 // Currently only supports Windows CryptoAPI and NSS sqlite3 stores.
 
-var log, Log = xlog.New("ncdns.certinject")
-
 var (
 	cryptoApiFlag = cflag.Bool(flagGroup, "cryptoapi", false,
 		"Synchronize TLS certs to the CryptoAPI trust store?  This "+