diff --git a/crypto/openssh/config.h b/crypto/openssh/config.h
index ecd014b805e6..3c8625566903 100644
--- a/crypto/openssh/config.h
+++ b/crypto/openssh/config.h
@@ -1408,7 +1408,7 @@
 /* #undef LASTLOG_WRITE_PUTUTXLINE */
 
 /* Define if you want TCP Wrappers support */
-#define LIBWRAP 1
+/* #undef LIBWRAP */
 
 /* Define to whatever link() returns for "not supported" if it doesn't return
    EOPNOTSUPP. */
diff --git a/secure/usr.sbin/sshd/Makefile b/secure/usr.sbin/sshd/Makefile
index 93ae32bbaeab..ff82ebf25ca2 100644
--- a/secure/usr.sbin/sshd/Makefile
+++ b/secure/usr.sbin/sshd/Makefile
@@ -25,8 +25,8 @@ MAN=	sshd.8 sshd_config.5
 CFLAGS+=-I${SSHDIR} -include ssh_namespace.h
 SRCS+=	ssh_namespace.h
 
-DPADD=	${LIBSSH} ${LIBUTIL} ${LIBWRAP} ${LIBPAM}
-LDADD=	-lssh -lutil -lwrap ${MINUSLPAM}
+DPADD=	${LIBSSH} ${LIBUTIL} ${LIBPAM}
+LDADD=	-lssh -lutil ${MINUSLPAM}
 USEPRIVATELIB= ssh
 
 .if ${MK_LDNS} != "no"
@@ -51,6 +51,12 @@ LDADD+=	 -lgssapi_krb5 -lgssapi -lkrb5 -lhx509 -lasn1 \
 	-lcom_err -lroken -lwind -lheimbase -lheimipcc
 .endif
 
+.if ${MK_TCP_WRAPPERS} != "no"
+CFLAGS+=	-DLIBWRAP
+DPADD+=		${LIBWRAP}
+LDADD+=		-lwrap
+.endif
+
 DPADD+= ${LIBCRYPT} ${LIBCRYPTO} ${LIBZ}
 LDADD+= -lcrypt -lcrypto -lz