diff --git a/tests/sys/capsicum/Makefile b/tests/sys/capsicum/Makefile
index 5c62931ee89e..6b0e53fa0865 100644
--- a/tests/sys/capsicum/Makefile
+++ b/tests/sys/capsicum/Makefile
@@ -5,7 +5,7 @@ TESTSDIR=	${TESTSBASE}/sys/capsicum
 ATF_TESTS_C+=	bindat_connectat
 ATF_TESTS_C+=	ioctls_test
 
-CFLAGS.bindat_connectat.c+=	-I${SRCTOP}/tests
+CFLAGS+=	-I${SRCTOP}/tests
 
 WARNS?=	6
 
diff --git a/tests/sys/capsicum/ioctls_test.c b/tests/sys/capsicum/ioctls_test.c
index b1c90e073bd1..df5098708864 100644
--- a/tests/sys/capsicum/ioctls_test.c
+++ b/tests/sys/capsicum/ioctls_test.c
@@ -37,6 +37,8 @@ __FBSDID("$FreeBSD$");
 
 #include <atf-c.h>
 
+#include "freebsd_test_suite/macros.h"
+
 /*
  * A variant of ATF_REQUIRE that is suitable for use in child
  * processes.  This only works if the parent process is tripped up by
@@ -73,6 +75,8 @@ ATF_TC_BODY(cap_ioctls__listen_copy, tc)
 	char dummy;
 	int s[2], status;
 
+	ATF_REQUIRE_FEATURE("security_capabilities");
+
 	s[0] = socket(AF_INET, SOCK_STREAM, 0);
 	ATF_REQUIRE(s[0] > 0);