diff --git a/stand/libsa/Makefile b/stand/libsa/Makefile
index 09637bd5e9d..dc35fe00750 100644
--- a/stand/libsa/Makefile
+++ b/stand/libsa/Makefile
@@ -184,6 +184,7 @@ SRCS+=  explicit_bzero.c crc32_libkern.c
 .endif
 
 .if ${MK_LOADER_VERIEXEC} == "yes" && ${MK_BEARSSL} == "yes"
+# XXX Note that these pollutes CFLAGS in a way that's not easy to fix
 .include "${SRCTOP}/lib/libbearssl/Makefile.libsa.inc"
 .include "${SRCTOP}/lib/libsecureboot/Makefile.libsa.inc"
 .endif