diff --git a/usr.sbin/bsdinstall/scripts/hardening b/usr.sbin/bsdinstall/scripts/hardening
--- a/usr.sbin/bsdinstall/scripts/hardening
+++ b/usr.sbin/bsdinstall/scripts/hardening
@@ -30,22 +30,40 @@
 
 set_aslr_sysctls()
 {
-	for bit in 32 64; do
-		if ! sysctl -Nq kern.elf$bit.aslr.enable >/dev/null; then
-			continue
-		fi
-		cat >> $BSDINSTALL_TMPETC/sysctl.conf.hardening <<-EOF
-			kern.elf$bit.aslr.enable=1
-			kern.elf$bit.aslr.pie_enable=1
-			kern.elf$bit.aslr.honor_sbrk=0
-		EOF
-	done
+	local bit="$1"
+
+	sed -i '' "/kern.elf$bit.aslr/d" $BSDINSTALL_TMPETC/sysctl.conf.hardening
+	if ! sysctl -Nq kern.elf$bit.aslr.enable >/dev/null; then
+		return
+	fi
+	cat >> $BSDINSTALL_TMPETC/sysctl.conf.hardening <<-EOF
+		kern.elf$bit.aslr.enable=1
+		kern.elf$bit.aslr.pie_enable=1
+	EOF
 }
 
 echo -n > $BSDINSTALL_TMPETC/rc.conf.hardening
 echo -n > $BSDINSTALL_TMPETC/sysctl.conf.hardening
 echo -n > $BSDINSTALL_TMPBOOT/loader.conf.hardening
 
+#
+# The ASLR feature is disabled on 32- and enabled on 64-bit
+# architectures. In order to handle both cases in a single menu,
+# tick the "enable_aslr" option for the latter, so the default behavior
+# remains intact.
+#
+elfdump -a /boot/kernel/kernel | grep ELFCLASS64 > /dev/null
+if [ $? -eq 0 ]; then
+	arch_bits=64
+	enable_aslr="on"
+	cat >> $BSDINSTALL_TMPETC/sysctl.conf.hardening <<-EOF
+		kern.elf64.aslr.enable=0
+		kern.elf64.aslr.pie_enable=0
+	EOF
+else
+	arch_bits=32
+fi
+
 exec 3>&1
 FEATURES=$( dialog --backtitle "FreeBSD Installer" \
     --title "System Hardening" --nocancel --separate-output \
@@ -62,7 +80,7 @@
 	"8 disable_sendmail" "Disable Sendmail service" ${disable_sendmail:-off} \
 	"9 secure_console" "Enable console password prompt" ${secure_console:-off} \
 	"10 disable_ddtrace" "Disallow DTrace destructive-mode" ${disable_ddtrace:-off} \
-	"11 enable_aslr" "Enable address layout randomization" ${enable_aslr:-off} \
+	"11 enable_aslr" "Enable address layout randomization for $arch_bits-bit executables" ${enable_aslr:-off} \
 2>&1 1>&3 )
 exec 3>&-
 
@@ -102,7 +120,7 @@
 		echo 'security.bsd.allow_destructive_dtrace=0' >> $BSDINSTALL_TMPBOOT/loader.conf.hardening
 		;;
 	enable_aslr)
-		set_aslr_sysctls
+		set_aslr_sysctls $arch_bits
 		;;
 	esac
 done