diff --git a/crypto/openssh/config.h b/crypto/openssh/config.h
index 364ebe33e2e..ca1ce8e3852 100644
--- a/crypto/openssh/config.h
+++ b/crypto/openssh/config.h
@@ -1408,7 +1408,7 @@
 /* #undef LASTLOG_WRITE_PUTUTXLINE */
 
 /* Define if you want TCP Wrappers support */
-#define LIBWRAP 1
+/* #undef LIBWRAP */
 
 /* Define to whatever link() returns for "not supported" if it doesn't return
    EOPNOTSUPP. */
diff --git a/secure/usr.sbin/sshd/Makefile b/secure/usr.sbin/sshd/Makefile
index a3c645494a3..5fb1e23a2a4 100644
--- a/secure/usr.sbin/sshd/Makefile
+++ b/secure/usr.sbin/sshd/Makefile
@@ -27,7 +27,7 @@ CFLAGS+=-I${SSHDIR} -include ssh_namespace.h
 SRCS+=	ssh_namespace.h
 
 # pam should always happen before ssh here for static linking
-LIBADD=	pam ssh util wrap
+LIBADD=	pam ssh util
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
@@ -53,6 +53,11 @@ SRCS+=	krb5_config.h
 LIBADD+=	gssapi_krb5 gssapi krb5
 .endif
 
+.if ${MK_TCP_WRAPPERS} != "no"
+CFLAGS+=	-DLIBWRAP
+LIBADD+=	wrap
+.endif
+
 LIBADD+=	crypto
 
 .if defined(LOCALBASE)