diff --git a/crypto/openssh/krb5_config.h b/crypto/openssh/krb5_config.h
--- a/crypto/openssh/krb5_config.h
+++ b/crypto/openssh/krb5_config.h
@@ -6,5 +6,4 @@
 #define HAVE_KRB5_CC_NEW_UNIQUE 1
 #define HAVE_KRB5_FREE_ERROR_MESSAGE 1
 #define HAVE_KRB5_GET_ERROR_MESSAGE 1
-#define HEIMDAL 1
 #define KRB5 1
diff --git a/secure/libexec/sshd-session/Makefile b/secure/libexec/sshd-session/Makefile
--- a/secure/libexec/sshd-session/Makefile
+++ b/secure/libexec/sshd-session/Makefile
@@ -40,6 +40,15 @@
 
 .if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
 LIBADD+=	gssapi_krb5 gssapi krb5
+.if ${MK_MITKRB5} != "no"
+.include "../../krb5/Makefile.inc"
+CFLAGS+=	-I${KRB5_DIR}/include \
+		-I${KRB5_SRCTOP}/include \
+		-I${KRB5_OBJTOP}/lib \
+		-I${KRB5_DIR}/lib/gssapi/generic \
+		-I${KRB5_DIR}/lib/gssapi/krb5 \
+		-I${KRB5_DIR}/lib/gssapi/mechglue
+.endif
 .endif
 
 .if ${MK_TCP_WRAPPERS} != "no"
diff --git a/secure/ssh.mk b/secure/ssh.mk
--- a/secure/ssh.mk
+++ b/secure/ssh.mk
@@ -11,6 +11,10 @@
 
 .if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
 CFLAGS+= -include krb5_config.h
+.if ${MK_MITKRB5} == "no"
+CFLAGS+= -DHEIMDAL=1
+.endif
+
 .endif
 
 CFLAGS+= -DXAUTH_PATH=\"${LOCALBASE:U/usr/local}/bin/xauth\"