diff --git a/sys/conf/config.mk b/sys/conf/config.mk
index 50188eee923b..563e9d0a3628 100644
--- a/sys/conf/config.mk
+++ b/sys/conf/config.mk
@@ -30,6 +30,8 @@ opt_inet.h:
 opt_inet6.h:
 	@echo "#define INET6 1" > ${.TARGET}
 .endif
+opt_ipsec.h:
+	@echo "#define IPSEC_SUPPORT 1" > ${.TARGET}
 .if ${MK_RATELIMIT} != "no"
 opt_ratelimit.h:
 	@echo "#define RATELIMIT 1" > ${.TARGET}
diff --git a/sys/modules/ipsec/Makefile b/sys/modules/ipsec/Makefile
index 01b92c57643d..46472f910d16 100644
--- a/sys/modules/ipsec/Makefile
+++ b/sys/modules/ipsec/Makefile
@@ -8,7 +8,4 @@ SRCS=	if_ipsec.c ipsec.c ipsec_input.c ipsec_mbuf.c ipsec_mod.c \
 	opt_inet.h opt_inet6.h opt_ipsec.h opt_sctp.h 
 SRCS.INET=	udpencap.c
 
-opt_ipsec.h:
-	@echo "#define IPSEC_SUPPORT 1" > ${.TARGET}
-
 .include <bsd.kmod.mk>
diff --git a/sys/modules/tcp/tcpmd5/Makefile b/sys/modules/tcp/tcpmd5/Makefile
index a92e78747948..e2d96195d806 100644
--- a/sys/modules/tcp/tcpmd5/Makefile
+++ b/sys/modules/tcp/tcpmd5/Makefile
@@ -5,7 +5,4 @@
 KMOD=   tcpmd5
 SRCS=   xform_tcp.c opt_inet.h opt_inet6.h opt_ipsec.h
 
-opt_ipsec.h:
-	@echo "#define IPSEC_SUPPORT 1" > ${.TARGET}
-
 .include <bsd.kmod.mk>