diff --git a/sys/kern/sys_capability.c b/sys/kern/sys_capability.c
index f2dd750bffa9..807521f55f3f 100644
--- a/sys/kern/sys_capability.c
+++ b/sys/kern/sys_capability.c
@@ -86,7 +86,7 @@ __FBSDID("$FreeBSD$");
 #include <vm/vm.h>
 
 bool __read_frequently trap_enotcap;
-SYSCTL_BOOL(_kern, OID_AUTO, trap_enotcap, CTLFLAG_RW, &trap_enotcap, 0,
+SYSCTL_BOOL(_kern, OID_AUTO, trap_enotcap, CTLFLAG_RWTUN, &trap_enotcap, 0,
     "Deliver SIGTRAP on ENOTCAPABLE");
 
 #ifdef CAPABILITY_MODE