Index: head/crypto/openssh/config.h
===================================================================
--- head/crypto/openssh/config.h
+++ head/crypto/openssh/config.h
@@ -1408,7 +1408,7 @@
 /* #undef LASTLOG_WRITE_PUTUTXLINE */
 
 /* Define if you want TCP Wrappers support */
-#define LIBWRAP 1
+/* #undef LIBWRAP */
 
 /* Define to whatever link() returns for "not supported" if it doesn't return
    EOPNOTSUPP. */
Index: head/secure/usr.sbin/sshd/Makefile
===================================================================
--- head/secure/usr.sbin/sshd/Makefile
+++ head/secure/usr.sbin/sshd/Makefile
@@ -27,7 +27,7 @@
 SRCS+=	ssh_namespace.h
 
 # pam should always happen before ssh here for static linking
-LIBADD=	pam ssh util wrap
+LIBADD=	pam ssh util
 
 .if ${MK_LDNS} != "no"
 CFLAGS+=	-DHAVE_LDNS=1
@@ -53,6 +53,11 @@
 LIBADD+=	gssapi_krb5 gssapi krb5
 .endif
 
+.if ${MK_TCP_WRAPPERS} != "no"
+CFLAGS+=	-DLIBWRAP
+LIBADD+=	wrap
+.endif
+
 LIBADD+=	crypto
 
 .if defined(LOCALBASE)