diff --git a/secure/usr.bin/ssh/Makefile b/secure/usr.bin/ssh/Makefile
index 1c666ab77170..33bdba1b2088 100644
--- a/secure/usr.bin/ssh/Makefile
+++ b/secure/usr.bin/ssh/Makefile
@@ -22,7 +22,16 @@ DPADD+=	 ${LIBGSSAPI}
 LDADD+=	 -lgssapi
 .endif
 
-.if defined(X11BASE)
+.if defined(X11BASE) || defined(LOCALBASE)
+# Recommended /etc/make.conf setting is X11BASE=${LOCALBASE} for x.org
+# 7.x upgrade on <= 6.2, but LOCALBASE has moved out of scope of src/
+# so we need to provide the default for users with old make.conf
+# settings.
+LOCALBASE?=	/usr/local
+
+# Users may override either LOCALBASE or X11BASE to move the location
+# of xauth
+X11BASE?=	${LOCALBASE}
 CFLAGS+= -DXAUTH_PATH=\"${X11BASE}/bin/xauth\"
 .endif
 
diff --git a/secure/usr.sbin/sshd/Makefile b/secure/usr.sbin/sshd/Makefile
index ddafee008c0c..9a9ddaee368c 100644
--- a/secure/usr.sbin/sshd/Makefile
+++ b/secure/usr.sbin/sshd/Makefile
@@ -38,6 +38,15 @@ LDADD+=	 -lgssapi -lkrb5 -lasn1 -lcom_err -lroken
 .endif
 
 .if defined(X11BASE)
+# Recommended /etc/make.conf setting is X11BASE=${LOCALBASE} for x.org
+# 7.x upgrade on <= 6.2, but LOCALBASE has moved out of scope of src/
+# so we need to provide the default for users with old make.conf
+# settings.
+LOCALBASE?=	/usr/local
+
+# Users may override either LOCALBASE or X11BASE to move the location
+# of xauth
+X11BASE?=	${LOCALBASE}
 CFLAGS+= -DXAUTH_PATH=\"${X11BASE}/bin/xauth\"
 .endif