diff --git a/secure/lib/libssh/Makefile b/secure/lib/libssh/Makefile
--- a/secure/lib/libssh/Makefile
+++ b/secure/lib/libssh/Makefile
@@ -49,7 +49,6 @@
 	kexsntrup761x25519.c kexmlkem768x25519.c sntrup761.c kexgen.c \
 	sftp-realpath.c platform-pledge.c platform-tracing.c platform-misc.c \
 	sshbuf-io.c
-SRCS+=	ssh-sk-client.c
 
 PACKAGE=	ssh
 
diff --git a/secure/libexec/ssh-keysign/Makefile b/secure/libexec/ssh-keysign/Makefile
--- a/secure/libexec/ssh-keysign/Makefile
+++ b/secure/libexec/ssh-keysign/Makefile
@@ -2,7 +2,7 @@
 .include "${SRCTOP}/secure/ssh.mk"
 
 PROG=	ssh-keysign
-SRCS=	ssh-keysign.c readconf.c uidswap.c
+SRCS=	ssh-keysign.c readconf.c uidswap.c $(SKSRCS)
 MAN=	ssh-keysign.8
 BINMODE=4555
 
diff --git a/secure/libexec/ssh-pkcs11-helper/Makefile b/secure/libexec/ssh-pkcs11-helper/Makefile
--- a/secure/libexec/ssh-pkcs11-helper/Makefile
+++ b/secure/libexec/ssh-pkcs11-helper/Makefile
@@ -2,7 +2,7 @@
 .include "${SRCTOP}/secure/ssh.mk"
 
 PROG=	ssh-pkcs11-helper
-SRCS=	ssh-pkcs11-helper.c ssh-pkcs11.c
+SRCS=	ssh-pkcs11-helper.c ssh-pkcs11.c $(SKSRCS)
 MAN=	ssh-pkcs11-helper.8
 
 LIBADD=	crypto ssh
diff --git a/secure/libexec/sshd-session/Makefile b/secure/libexec/sshd-session/Makefile
--- a/secure/libexec/sshd-session/Makefile
+++ b/secure/libexec/sshd-session/Makefile
@@ -15,7 +15,7 @@
 	sftp-server.c sftp-common.c \
 	sandbox-null.c sandbox-rlimit.c sandbox-systrace.c sandbox-darwin.c \
 	sandbox-seccomp-filter.c sandbox-capsicum.c sandbox-pledge.c \
-	sandbox-solaris.c uidswap.c
+	sandbox-solaris.c uidswap.c $(SKSRCS)
 PACKAGE=	ssh
 
 # gss-genr.c really belongs in libssh; see src/secure/lib/libssh/Makefile
diff --git a/secure/ssh.mk b/secure/ssh.mk
--- a/secure/ssh.mk
+++ b/secure/ssh.mk
@@ -4,6 +4,8 @@
 
 SSHDIR=		${SRCTOP}/crypto/openssh
 
+SKSRCS=	ssh-sk-client.c
+
 CFLAGS+= -I${SSHDIR} -include ssh_namespace.h
 
 .if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
diff --git a/secure/usr.bin/ssh-add/Makefile b/secure/usr.bin/ssh-add/Makefile
--- a/secure/usr.bin/ssh-add/Makefile
+++ b/secure/usr.bin/ssh-add/Makefile
@@ -2,7 +2,7 @@
 .include "${SRCTOP}/secure/ssh.mk"
 
 PROG=	ssh-add
-SRCS=	ssh-add.c ssh-sk-client.c
+SRCS=	ssh-add.c $(SKSRCS)
 PACKAGE=	ssh
 
 LIBADD=	ssh
diff --git a/secure/usr.bin/ssh-agent/Makefile b/secure/usr.bin/ssh-agent/Makefile
--- a/secure/usr.bin/ssh-agent/Makefile
+++ b/secure/usr.bin/ssh-agent/Makefile
@@ -2,7 +2,7 @@
 .include "${SRCTOP}/secure/ssh.mk"
 
 PROG=	ssh-agent
-SRCS=	ssh-agent.c ssh-pkcs11-client.c
+SRCS=	ssh-agent.c ssh-pkcs11-client.c $(SKSRCS)
 PACKAGE=	ssh
 
 LIBADD=	crypto ssh
diff --git a/secure/usr.bin/ssh-keygen/Makefile b/secure/usr.bin/ssh-keygen/Makefile
--- a/secure/usr.bin/ssh-keygen/Makefile
+++ b/secure/usr.bin/ssh-keygen/Makefile
@@ -2,8 +2,7 @@
 .include "${SRCTOP}/secure/ssh.mk"
 
 PROG=	ssh-keygen
-# XXX ssh-sk-client.c in libssh maybe?
-SRCS=	ssh-keygen.c sshsig.c ssh-sk-client.c
+SRCS=	ssh-keygen.c sshsig.c $(SKSRCS)
 PACKAGE=	ssh
 
 LIBADD=	crypto ssh
diff --git a/secure/usr.bin/ssh-keyscan/Makefile b/secure/usr.bin/ssh-keyscan/Makefile
--- a/secure/usr.bin/ssh-keyscan/Makefile
+++ b/secure/usr.bin/ssh-keyscan/Makefile
@@ -2,7 +2,7 @@
 .include "${SRCTOP}/secure/ssh.mk"
 
 PROG=	ssh-keyscan
-SRCS=	ssh-keyscan.c
+SRCS=	ssh-keyscan.c $(SKSRCS)
 PACKAGE=	ssh
 
 LIBADD=	ssh
diff --git a/secure/usr.bin/ssh/Makefile b/secure/usr.bin/ssh/Makefile
--- a/secure/usr.bin/ssh/Makefile
+++ b/secure/usr.bin/ssh/Makefile
@@ -10,7 +10,7 @@
 PACKAGE=	ssh
 
 SRCS=	ssh.c readconf.c clientloop.c sshtty.c \
-	sshconnect.c sshconnect2.c mux.c
+	sshconnect.c sshconnect2.c mux.c $(SKSRCS)
 
 # gss-genr.c really belongs in libssh; see src/secure/lib/libssh/Makefile
 SRCS+=	gss-genr.c
diff --git a/secure/usr.sbin/sshd/Makefile b/secure/usr.sbin/sshd/Makefile
--- a/secure/usr.sbin/sshd/Makefile
+++ b/secure/usr.sbin/sshd/Makefile
@@ -7,7 +7,8 @@
 SRCS=	sshd.c \
 	platform-listen.c \
 	servconf.c sshpty.c srclimit.c groupaccess.c auth2-methods.c \
-	dns.c fatal.c compat.c utf8.c authfd.c canohost.c
+	dns.c fatal.c compat.c utf8.c authfd.c canohost.c \
+	$(SKSRCS)
 PACKAGE=	ssh
 
 MAN=	sshd.8 sshd_config.5