diff --git a/tools/build/Makefile b/tools/build/Makefile
--- a/tools/build/Makefile
+++ b/tools/build/Makefile
@@ -204,7 +204,13 @@
 SRCS+=	progname.c
 # Stub implementations of fflagstostr/strtofflags
 SRCS+=	fflags.c
-.endif
+.endif # ${MAKE.OS} == "Linux"
+
+.if ${.MAKE.OS} == "Darwin"
+# Standalone implementation of secure_getenv(), not available on MacOS.
+SRCS+=	secure_getenv.c
+.endif # ${MAKE.OS} == "Darwin"
+
 # Provide the same arc4random implementation on Linux/macOS
 CFLAGS.arc4random.c+=	-I${SRCTOP}/sys/crypto/chacha20 -D__isthreaded=1
 SRCS+=	arc4random.c arc4random_uniform.c
@@ -227,7 +233,7 @@
 	cp ${.ALLSRC} ${.TARGET}
 SRCS+=	subr_capability.c
 CLEANFILES+=	subr_capability.c
-.endif
+.endif # ${MAKE.OS} != "FreeBSD"
 
 CASPERINC+=	${SRCTOP}/lib/libcasper/services/cap_fileargs/cap_fileargs.h
 CASPERINC+=	${SRCTOP}/lib/libcasper/services/cap_net/cap_net.h
diff --git a/tools/build/cross-build/include/mac/stdlib.h b/tools/build/cross-build/include/mac/stdlib.h
--- a/tools/build/cross-build/include/mac/stdlib.h
+++ b/tools/build/cross-build/include/mac/stdlib.h
@@ -42,6 +42,7 @@
 
 int rpmatch(const char *response);
 
+char *secure_getenv(const char *name);
 long long strtonum(const char *numstr, long long minval, long long maxval,
     const char **errstrp);
 
diff --git a/tools/build/cross-build/secure_getenv.c b/tools/build/cross-build/secure_getenv.c
new file mode 100644
--- /dev/null
+++ b/tools/build/cross-build/secure_getenv.c
@@ -0,0 +1,16 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2023 Mark Johnston <markj@FreeBSD.org>
+ */
+
+#include <stdlib.h>
+#include <unistd.h>
+
+char *
+secure_getenv(const char *name)
+{
+	if (issetugid() != 0)
+		return (NULL);
+	return (getenv(name));
+}