9 files changed, 14 insertions, 9 deletions
diff --git a/secure/lib/libcrypto/Makefile b/secure/lib/libcrypto/Makefile
index e7e491124241..7e2350fb33ea 100644
--- a/secure/lib/libcrypto/Makefile
+++ b/secure/lib/libcrypto/Makefile
@@ -1,7 +1,10 @@
 SHLIBDIR?=	/lib
-.if !defined(LIBCRYPTO_WITHOUT_SUBDIRS)
+.if !defined(LIBCRYPTO_WITHOUT_SUBDIRS) && !defined(BOOTSTRAPPING)
 SUBDIR=		engines modules
 .endif
+.ifdef BOOTSTRAPPING
+CFLAGS+=	-DOPENSSL_NO_SCTP
+.endif
 
 .include <bsd.own.mk>
 .include <src.opts.mk>
diff --git a/secure/lib/libcrypto/Makefile.common b/secure/lib/libcrypto/Makefile.common
index afcc2a48660c..ad48e2b434cf 100644
--- a/secure/lib/libcrypto/Makefile.common
+++ b/secure/lib/libcrypto/Makefile.common
@@ -6,7 +6,7 @@ CFLAGS+=	-DL_ENDIAN
 CFLAGS+=	-DB_ENDIAN
 .endif
 
-.ifndef WITHOUT_AUTO_ASM
+.if !defined(WITHOUT_AUTO_ASM) && !defined(BOOTSTRAPPING)
 .if ${MACHINE_CPUARCH} == "aarch64" || ${MACHINE_CPUARCH} == "amd64" || \
     ${MACHINE_CPUARCH} == "arm" || ${MACHINE_CPUARCH} == "i386"
 ASM_${MACHINE_CPUARCH}=
diff --git a/secure/lib/libcrypto/Makefile.inc b/secure/lib/libcrypto/Makefile.inc
index 55e1687b58cf..f0ed4a5f3651 100644
--- a/secure/lib/libcrypto/Makefile.inc
+++ b/secure/lib/libcrypto/Makefile.inc
@@ -1,8 +1,7 @@
 .include <bsd.own.mk>
 
 # OpenSSL version used for manual page generation
-OPENSSL_VER=	3.5.0
-OPENSSL_DATE=	2025-07-01
+.include "Makefile.version"
 
 LCRYPTO_SRC=	${SRCTOP}/crypto/openssl
 LCRYPTO_DOC=	${LCRYPTO_SRC}/doc
diff --git a/secure/lib/libcrypto/Makefile.version b/secure/lib/libcrypto/Makefile.version
new file mode 100644
index 000000000000..e802a1f11618
--- /dev/null
+++ b/secure/lib/libcrypto/Makefile.version
@@ -0,0 +1,2 @@
+OPENSSL_VER=	3.5.1
+OPENSSL_DATE=	2025-07-01
diff --git a/secure/lib/libssl/Makefile b/secure/lib/libssl/Makefile
index 45f23c9e9ca2..682c7bbc2693 100644
--- a/secure/lib/libssl/Makefile
+++ b/secure/lib/libssl/Makefile
@@ -73,6 +73,8 @@ SRCS+=	rio_notifier.c poll_builder.c
 
 .if ${MK_OPENSSL_KTLS} == "no"
 CFLAGS+=-DOPENSSL_NO_KTLS
+.else
+SRCS+=	ktls_meth.c
 .endif
 
 LIBADD=	crypto
diff --git a/secure/libexec/sshd-session/Makefile b/secure/libexec/sshd-session/Makefile
index 37e099794bd5..5ed459fe492a 100644
--- a/secure/libexec/sshd-session/Makefile
+++ b/secure/libexec/sshd-session/Makefile
@@ -38,7 +38,7 @@ LIBADD+= blacklist
 LDFLAGS+=-L${LIBBLACKLISTDIR}
 .endif
 
-.if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
+.if ${MK_KERBEROS_SUPPORT} != "no"
 .if ${MK_MITKRB5} != "no"
 LIBADD+=	gssapi_krb5 krb5
 .include "../../krb5/Makefile.inc"
diff --git a/secure/ssh.mk b/secure/ssh.mk
index bb6dd9b748e4..97dd089d98e8 100644
--- a/secure/ssh.mk
+++ b/secure/ssh.mk
@@ -9,12 +9,11 @@ SKSRCS=	ssh-sk-client.c
 
 CFLAGS+= -I${SSHDIR} -include ssh_namespace.h
 
-.if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
+.if ${MK_KERBEROS_SUPPORT} != "no"
 CFLAGS+= -include krb5_config.h
 .if ${MK_MITKRB5} == "no"
 CFLAGS+= -DHEIMDAL=1
 .endif
-
 .endif
 
 CFLAGS+= -DXAUTH_PATH=\"${LOCALBASE:U/usr/local}/bin/xauth\"
diff --git a/secure/usr.bin/ssh/Makefile b/secure/usr.bin/ssh/Makefile
index a4f36d0fe2df..2b11b783c007 100644
--- a/secure/usr.bin/ssh/Makefile
+++ b/secure/usr.bin/ssh/Makefile
@@ -17,7 +17,7 @@ SRCS+=	gss-genr.c
 
 LIBADD=	ssh
 
-.if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
+.if ${MK_KERBEROS_SUPPORT} != "no"
 .if ${MK_MITKRB5} == "no"
 LIBADD+=	gssapi
 .else
diff --git a/secure/usr.sbin/sshd/Makefile b/secure/usr.sbin/sshd/Makefile
index f37dfe1c1b3a..433a87984e42 100644
--- a/secure/usr.sbin/sshd/Makefile
+++ b/secure/usr.sbin/sshd/Makefile
@@ -18,7 +18,7 @@ moduli: .MADE
 
 LIBADD=	ssh util
 
-.if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
+.if ${MK_KERBEROS_SUPPORT} != "no"
 .if ${MK_MITKRB5} == "no"
 LIBADD+=	gssapi_krb5 gssapi krb5
 .else