diff --git a/sys/conf/kern.opts.mk b/sys/conf/kern.opts.mk
index 35ce97fae63..53992a31d07 100644
--- a/sys/conf/kern.opts.mk
+++ b/sys/conf/kern.opts.mk
@@ -62,7 +62,8 @@ __DEFAULT_NO_OPTIONS = \
     INIT_ALL_ZERO \
     KERNEL_RETPOLINE \
     RATELIMIT \
-    REPRODUCIBLE_BUILD
+    REPRODUCIBLE_BUILD \
+    VERIEXEC
 
 # Some options are totally broken on some architectures. We disable
 # them. If you need to enable them on an experimental basis, you
diff --git a/sys/modules/Makefile b/sys/modules/Makefile
index 71e0be4cce2..df47f5bf465 100644
--- a/sys/modules/Makefile
+++ b/sys/modules/Makefile
@@ -588,12 +588,14 @@ _mac_priority=	mac_priority
 _mac_seeotheruids= mac_seeotheruids
 _mac_stub=	mac_stub
 _mac_test=	mac_test
+.if ${MK_VERIEXEC} != "no" || defined(ALL_MODULES)
 _mac_veriexec=	mac_veriexec
 _mac_veriexec_sha1= mac_veriexec_sha1
 _mac_veriexec_sha256= mac_veriexec_sha256
 _mac_veriexec_sha384= mac_veriexec_sha384
 _mac_veriexec_sha512= mac_veriexec_sha512
 .endif
+.endif
 
 .if ${MK_NETGRAPH} != "no" || defined(ALL_MODULES)
 _netgraph=	netgraph