diff --git a/bin/ed/Makefile b/bin/ed/Makefile
index fb1c37da3d01..cc47a4271e92 100644
--- a/bin/ed/Makefile
+++ b/bin/ed/Makefile
@@ -7,9 +7,7 @@ SRCS= buf.c cbc.c glbl.c io.c main.c re.c sub.c undo.c
LINKS= ${BINDIR}/ed ${BINDIR}/red
MLINKS= ed.1 red.1
-.if !defined(RELEASE_CRUNCH) && \
- ${MK_OPENSSL} != "no" && \
- ${MK_ED_CRYPTO} != "no"
+.if ${MK_OPENSSL} != "no" && ${MK_ED_CRYPTO} != "no"
CFLAGS+=-DDES
DPADD= ${LIBCRYPTO}
LDADD= -lcrypto
diff --git a/lib/libtelnet/Makefile b/lib/libtelnet/Makefile
index 1d388799a08a..3ddecf08e5e2 100644
--- a/lib/libtelnet/Makefile
+++ b/lib/libtelnet/Makefile
@@ -15,7 +15,6 @@ CFLAGS+= -I${TELNETDIR}
WARNS?= 2
-.if !defined(RELEASE_CRUNCH)
.if ${MK_OPENSSL} != "no"
SRCS+= encrypt.c auth.c enc_des.c sra.c pk.c
CFLAGS+= -DENCRYPTION -DAUTHENTICATION -DSRA
@@ -26,7 +25,6 @@ SRCS+= kerberos5.c
CFLAGS+= -DKRB5 -I${KRB5DIR}/lib/krb5 -I${KRB5OBJDIR} -I${ASN1OBJDIR}
CFLAGS+= -DFORWARD -Dnet_write=telnet_net_write
.endif
-.endif
INCS= ${TELNETDIR}/arpa/telnet.h
INCSDIR= ${INCLUDEDIR}/arpa
diff --git a/libexec/telnetd/Makefile b/libexec/telnetd/Makefile
index 99f023f263f2..4300d0dd9254 100644
--- a/libexec/telnetd/Makefile
+++ b/libexec/telnetd/Makefile
@@ -31,8 +31,6 @@ LIBTELNET= ${.OBJDIR}/../../lib/libtelnet/libtelnet.a
DPADD= ${LIBUTIL} ${LIBTERMCAP} ${LIBTELNET}
LDADD= -lutil -ltermcap ${LIBTELNET}
-# XXX for src/release/picobsd
-.if !defined(RELEASE_CRUNCH)
.if ${MK_OPENSSL} != "no"
SRCS+= authenc.c
CFLAGS+= -DAUTHENTICATION -DENCRYPTION
@@ -45,6 +43,5 @@ CFLAGS+= -DKRB5 -DFORWARD -Dnet_write=telnet_net_write
DPADD+= ${LIBKRB5} ${LIBHX509} ${LIBASN1} ${LIBROKEN} ${LIBCOM_ERR}
LDADD+= -lkrb5 -lhx509 -lasn1 -lroken -lcom_err
.endif
-.endif
.include <bsd.prog.mk>
diff --git a/release/picobsd/bridge/crunch.conf b/release/picobsd/bridge/crunch.conf
index c525ee120856..fce2897306b1 100644
--- a/release/picobsd/bridge/crunch.conf
+++ b/release/picobsd/bridge/crunch.conf
@@ -31,6 +31,7 @@
buildopts -DWITHOUT_PAM -DRELEASE_CRUNCH -DPPP_NO_NETGRAPH
buildopts -DTRACEROUTE_NO_IPSEC -DNO_INET6
+buildopts -DWITHOUT_KERBEROS -DWITHOUT_OPENSSL
# Directories where to look for sources of various binaries.
# @__CWD__@ is a magic keyword in the picobsd's (Makefile.conf)
diff --git a/release/picobsd/qemu/crunch.conf b/release/picobsd/qemu/crunch.conf
index 3b0434006bc4..58a5544f405b 100644
--- a/release/picobsd/qemu/crunch.conf
+++ b/release/picobsd/qemu/crunch.conf
@@ -31,6 +31,7 @@
buildopts -DWITHOUT_PAM -DRELEASE_CRUNCH -DPPP_NO_NETGRAPH
buildopts -DTRACEROUTE_NO_IPSEC -DNO_INET6
+buildopts -DWITHOUT_KERBEROS -DWITHOUT_OPENSSL
# Directories where to look for sources of various binaries.
# @__CWD__@ is a magic keyword in the picobsd's (Makefile.conf)
diff --git a/usr.bin/telnet/Makefile b/usr.bin/telnet/Makefile
index d47bb91c4eb7..adee9dc134f3 100644
--- a/usr.bin/telnet/Makefile
+++ b/usr.bin/telnet/Makefile
@@ -34,7 +34,6 @@ SRCS+= genget.c getent.c misc.c
CFLAGS+= -DHAS_CGETENT
.endif
-.if !defined(RELEASE_CRUNCH)
.if ${MK_OPENSSL} != "no"
SRCS+= authenc.c
CFLAGS+= -DENCRYPTION -DAUTHENTICATION -DIPSEC
@@ -47,6 +46,5 @@ CFLAGS+= -DKRB5 -DFORWARD -Dnet_write=telnet_net_write
DPADD+= ${LIBKRB5} ${LIBHX509} ${LIBASN1} ${LIBCOM_ERR} ${LIBROKEN}
LDADD+= -lkrb5 -lhx509 -lasn1 -lcom_err -lroken
.endif
-.endif
.include <bsd.prog.mk>
diff --git a/usr.sbin/ntp/ntp-keygen/Makefile b/usr.sbin/ntp/ntp-keygen/Makefile
index fea148cb076c..78308fae0ac8 100644
--- a/usr.sbin/ntp/ntp-keygen/Makefile
+++ b/usr.sbin/ntp/ntp-keygen/Makefile
@@ -16,7 +16,7 @@ CFLAGS+= -I${.CURDIR}/../../../contrib/ntp/include -I${.CURDIR}/../ \
DPADD= ${LIBNTP} ${LIBOPTS}
LDADD= ${LIBNTP} ${LIBOPTS}
-.if ${MK_OPENSSL} != "no" && !defined(RELEASE_CRUNCH)
+.if ${MK_OPENSSL} != "no"
DPADD+= ${LIBMD} ${LIBCRYPTO}
LDADD+= -lmd -lcrypto
.endif
diff --git a/usr.sbin/ntp/ntpd/Makefile b/usr.sbin/ntp/ntpd/Makefile
index 53f537f71343..87b2d72b8544 100644
--- a/usr.sbin/ntp/ntpd/Makefile
+++ b/usr.sbin/ntp/ntpd/Makefile
@@ -35,7 +35,7 @@ CFLAGS+= -I${.CURDIR}/../../../contrib/ntp/include -I${.CURDIR}/../ \
DPADD= ${LIBPARSE} ${LIBNTP} ${LIBM} ${LIBMD} ${LIBRT} ${LIBOPTS}
LDADD= ${LIBPARSE} ${LIBNTP} -lm -lmd -lrt ${LIBOPTS}
-.if ${MK_OPENSSL} != "no" && !defined(RELEASE_CRUNCH)
+.if ${MK_OPENSSL} != "no"
DPADD+= ${LIBCRYPTO}
LDADD+= -lcrypto
.endif
diff --git a/usr.sbin/ppp/Makefile b/usr.sbin/ppp/Makefile
index a61ebf57501e..beea0ab6600f 100644
--- a/usr.sbin/ppp/Makefile
+++ b/usr.sbin/ppp/Makefile
@@ -76,8 +76,7 @@ CFLAGS+=-DNOSUID
SRCS+= id.c
.endif
-.if defined(RELEASE_CRUNCH) || ${MK_OPENSSL} == "no" || \
- defined(PPP_NO_DES)
+.if ${MK_OPENSSL} == "no" || defined(PPP_NO_DES)
CFLAGS+=-DNODES
.else
SRCS+= chap_ms.c mppe.c
diff --git a/usr.sbin/sendmail/Makefile b/usr.sbin/sendmail/Makefile
index f8a910bc1844..893b6fd0d70a 100644
--- a/usr.sbin/sendmail/Makefile
+++ b/usr.sbin/sendmail/Makefile
@@ -60,7 +60,7 @@ LDADD+= ${LIBSMUTIL} ${LIBSM}
SRCS+= sm_os.h
CLEANFILES+=sm_os.h
-.if ${MK_OPENSSL} != "no" && !defined(RELEASE_CRUNCH)
+.if ${MK_OPENSSL} != "no"
# STARTTLS support
CFLAGS+= -DSTARTTLS -D_FFR_TLS_1
DPADD+= ${LIBSSL} ${LIBCRYPTO}
diff --git a/usr.sbin/tcpdump/tcpdump/Makefile b/usr.sbin/tcpdump/tcpdump/Makefile
index 498287320737..fcaa13e3a354 100644
--- a/usr.sbin/tcpdump/tcpdump/Makefile
+++ b/usr.sbin/tcpdump/tcpdump/Makefile
@@ -167,7 +167,7 @@ DPADD+= ${LIBCAPSICUM} ${LIBNV}
LDADD+= -lcapsicum -lnv
CFLAGS+=-DHAVE_LIBCAPSICUM
.endif
-.if ${MK_OPENSSL} != "no" && !defined(RELEASE_CRUNCH)
+.if ${MK_OPENSSL} != "no"
DPADD+= ${LIBCRYPTO}
LDADD+= -lcrypto
CFLAGS+= -I${DESTDIR}/usr/include/openssl