diff --git a/etc/defaults/make.conf b/etc/defaults/make.conf
index 18a5a5ea585e..bf2918a2677b 100644
--- a/etc/defaults/make.conf
+++ b/etc/defaults/make.conf
@@ -57,6 +57,9 @@ BDECFLAGS=	-W -Wall -ansi -pedantic -Wbad-function-cast -Wcast-align \
 # To build ppp with normal permissions
 #PPP_NOSUID=	true
 #
+# To enable installing ssh(1) with the setuid bit turned on
+#ENABLE_SUID_SSH=	true
+#
 # To avoid building various parts of the base system:
 #NO_CVS=	true	# do not build CVS
 #NO_BIND=	true	# do not build BIND
diff --git a/secure/usr.bin/ssh/Makefile b/secure/usr.bin/ssh/Makefile
index 10dcbf0f8f09..0b99611f058c 100644
--- a/secure/usr.bin/ssh/Makefile
+++ b/secure/usr.bin/ssh/Makefile
@@ -5,7 +5,9 @@ SSHSRC=	${.CURDIR}/../../../crypto/openssh
 
 PROG=	ssh
 BINOWN=	root
+.if defined(ENABLE_SUID_SSH)
 BINMODE=4555
+.endif
 MAN1=	ssh.1
 LINKS=	${BINDIR}/ssh ${BINDIR}/slogin
 MLINKS=	ssh.1 slogin.1
diff --git a/share/examples/etc/make.conf b/share/examples/etc/make.conf
index 18a5a5ea585e..bf2918a2677b 100644
--- a/share/examples/etc/make.conf
+++ b/share/examples/etc/make.conf
@@ -57,6 +57,9 @@ BDECFLAGS=	-W -Wall -ansi -pedantic -Wbad-function-cast -Wcast-align \
 # To build ppp with normal permissions
 #PPP_NOSUID=	true
 #
+# To enable installing ssh(1) with the setuid bit turned on
+#ENABLE_SUID_SSH=	true
+#
 # To avoid building various parts of the base system:
 #NO_CVS=	true	# do not build CVS
 #NO_BIND=	true	# do not build BIND