diff --git a/share/mk/src.opts.mk b/share/mk/src.opts.mk
--- a/share/mk/src.opts.mk
+++ b/share/mk/src.opts.mk
@@ -211,6 +211,7 @@
     LOADER_VERIEXEC_PASS_MANIFEST \
     LLVM_FULL_DEBUGINFO \
     MALLOC_PRODUCTION \
+    MITKRB5 \
     OFED_EXTRA \
     OPENLDAP \
     REPRODUCIBLE_BUILD \
@@ -403,6 +404,7 @@
 MK_OPENSSH:=	no
 MK_KERBEROS:=	no
 MK_KERBEROS_SUPPORT:=	no
+MK_MITKRB5:=	no
 .endif
 
 .if ${MK_DTRACE} == "no"
@@ -429,6 +431,7 @@
 MK_OPENSSL_KTLS:=	no
 MK_KERBEROS:=	no
 MK_KERBEROS_SUPPORT:=	no
+MK_MITKRB5:=	no
 MK_LDNS:=	no
 MK_PKGBOOTSTRAP:=	no
 MK_LOADER_ZFS:=	no
diff --git a/tools/build/options/WITH_MITKRB5 b/tools/build/options/WITH_MITKRB5
new file mode 100644
--- /dev/null
+++ b/tools/build/options/WITH_MITKRB5
@@ -0,0 +1 @@
+Set this to build MIT Kerberos 5 instead of KTH Heimdal.