diff --git a/secure/Makefile b/secure/Makefile
index c3b2c87e1462..c7845d4c8057 100644
--- a/secure/Makefile
+++ b/secure/Makefile
@@ -21,7 +21,7 @@ SPROGS+=usr.sbin/sendmail
 # This target is used to rebuild these programs with crypto.
 secure: .MAKE .PHONY
 .for entry in ${SPROGS}
-	cd ${.CURDIR}/../${entry}; \
+	cd ${.CURDIR:H}/${entry}; \
 	${MAKE} cleandir; \
 	${MAKE} obj; \
 	${MAKE} all; \
@@ -31,7 +31,7 @@ secure: .MAKE .PHONY
 # This target is used to rebuild these programs without crypto.
 insecure: .MAKE .PHONY
 .for entry in ${SPROGS}
-	cd ${.CURDIR}/../${entry}; \
+	cd ${.CURDIR:H}/${entry}; \
 	${MAKE} MK_CRYPT=no cleandir; \
 	${MAKE} MK_CRYPT=no obj; \
 	${MAKE} MK_CRYPT=no all; \
diff --git a/secure/Makefile.inc b/secure/Makefile.inc
index ca4cb857f2f7..6c298be0223f 100644
--- a/secure/Makefile.inc
+++ b/secure/Makefile.inc
@@ -2,14 +2,14 @@
 
 .include <src.opts.mk>
 
-.if exists(${.CURDIR}/../../lib/libcrypt/obj)
-CRYPTOBJDIR=	${.CURDIR}/../../lib/libcrypt/obj
+.if exists(${.CURDIR:H:H}/lib/libcrypt/obj)
+CRYPTOBJDIR=	${.CURDIR:H:H}/lib/libcrypt/obj
 .else
-CRYPTOBJDIR=	${.CURDIR}/../../lib/libcrypt
+CRYPTOBJDIR=	${.CURDIR:H:H}/lib/libcrypt
 .endif
 
 .if ${MK_OPENSSH} != "no"
-SSHDIR=		${.CURDIR}/../../../crypto/openssh
+SSHDIR=		${SRCTOP}/crypto/openssh
 .endif
 
 WARNS?=		0
diff --git a/secure/lib/Makefile.inc b/secure/lib/Makefile.inc
index 002a3f70ef33..c6d2f5ba464e 100644
--- a/secure/lib/Makefile.inc
+++ b/secure/lib/Makefile.inc
@@ -1,6 +1,6 @@
 # $FreeBSD$
 
 .include "../Makefile.inc"
-.if exists(${.CURDIR}/../../../lib/Makefile.inc)
-.include "${.CURDIR}/../../../lib/Makefile.inc"
+.if exists(${.CURDIR:H:H:H}/lib/Makefile.inc)
+.include "${.CURDIR:H:H:H}/lib/Makefile.inc"
 .endif
diff --git a/secure/lib/libcrypto/Makefile.inc b/secure/lib/libcrypto/Makefile.inc
index 52f079e997e3..3c9f48b093ce 100644
--- a/secure/lib/libcrypto/Makefile.inc
+++ b/secure/lib/libcrypto/Makefile.inc
@@ -6,7 +6,7 @@
 OPENSSL_VER=	1.0.2k
 OPENSSL_DATE=	2017-01-26
 
-LCRYPTO_SRC=	${.CURDIR}/../../../crypto/openssl
+LCRYPTO_SRC=	${SRCTOP}/crypto/openssl
 LCRYPTO_DOC=	${LCRYPTO_SRC}/doc
 
 CFLAGS+=	-I${LCRYPTO_SRC}
diff --git a/secure/lib/libcrypto/engines/Makefile.inc b/secure/lib/libcrypto/engines/Makefile.inc
index 3ee4b2dadc5f..06800513668e 100644
--- a/secure/lib/libcrypto/engines/Makefile.inc
+++ b/secure/lib/libcrypto/engines/Makefile.inc
@@ -1,6 +1,6 @@
 # $FreeBSD$
 
-LCRYPTO_SRC=	${.CURDIR}/../../../../../crypto/openssl
+LCRYPTO_SRC=	${SRCTOP}/crypto/openssl
 .PATH: ${LCRYPTO_SRC}/engines ${LCRYPTO_SRC}/engines/ccgost
 
 SHLIBDIR?= /usr/lib/engines
diff --git a/secure/lib/libssh/Makefile b/secure/lib/libssh/Makefile
index cc9e65958998..8445edfca17e 100644
--- a/secure/lib/libssh/Makefile
+++ b/secure/lib/libssh/Makefile
@@ -37,7 +37,7 @@ SRCS+=	bcrypt_pbkdf.c blowfish.c bsd-misc.c explicit_bzero.c fmt_scaled.c \
 .if ${MK_LDNS} == "no"
 SRCS+=	getrrsetbyname.c
 .else
-LDNSDIR=	${.CURDIR}/../../../contrib/ldns
+LDNSDIR=	${SRCTOP}/contrib/ldns
 CFLAGS+=	-DHAVE_LDNS=1 -I${LDNSDIR}
 SRCS+=	getrrsetbyname-ldns.c
 LIBADD+=	ldns