diff --git a/sys/conf/config.mk b/sys/conf/config.mk
index 563e9d0a362..91bdee3f951 100644
--- a/sys/conf/config.mk
+++ b/sys/conf/config.mk
@@ -30,8 +30,10 @@ opt_inet.h:
 opt_inet6.h:
 	@echo "#define INET6 1" > ${.TARGET}
 .endif
+.if ${MK_IPSEC_SUPPORT} != "no"
 opt_ipsec.h:
 	@echo "#define IPSEC_SUPPORT 1" > ${.TARGET}
+.endif
 .if ${MK_RATELIMIT} != "no"
 opt_ratelimit.h:
 	@echo "#define RATELIMIT 1" > ${.TARGET}
@@ -60,6 +62,9 @@ KERN_OPTS+= INET TCP_OFFLOAD
 .if ${MK_INET6_SUPPORT} != "no"
 KERN_OPTS+= INET6
 .endif
+.if ${MK_IPSEC_SUPPORT} != "no"
+KERN_OPTS+= IPSEC_SUPPORT
+.endif
 .elif !defined(KERN_OPTS)
 # Add all the options that are mentioned in any opt_*.h file when we
 # have a kernel build directory to pull them from.
diff --git a/sys/modules/Makefile b/sys/modules/Makefile
index 4043ee54a87..6e9cb2b4516 100644
--- a/sys/modules/Makefile
+++ b/sys/modules/Makefile
@@ -427,7 +427,7 @@ _if_enc=	if_enc
 _if_gif=	if_gif
 _if_gre=	if_gre
 _ipfw_pmod=	ipfw_pmod
-.if ${MK_IPSEC_SUPPORT} != "no"
+.if ${KERN_OPTS:MIPSEC_SUPPORT}
 _ipsec=		ipsec
 .endif
 .endif
diff --git a/sys/modules/tcp/Makefile b/sys/modules/tcp/Makefile
index 45c4ef3df42..51c8066e3e8 100644
--- a/sys/modules/tcp/Makefile
+++ b/sys/modules/tcp/Makefile
@@ -2,8 +2,7 @@
 # $FreeBSD$
 #
 
-SYSDIR?=${SRCTOP}/sys
-.include "${SYSDIR}/conf/kern.opts.mk"
+.include <kmod.opts.mk>
 
 SUBDIR=	\
         ${_tcp_bbr} \
@@ -17,7 +16,7 @@ _tcp_rack= 	rack
 
 .if (${MK_INET_SUPPORT} != "no" || ${MK_INET6_SUPPORT} != "no") || \
 	defined(ALL_MODULES)
-.if ${MK_IPSEC_SUPPORT} != "no"
+.if ${KERN_OPTS:MIPSEC_SUPPORT}
 _tcpmd5=	tcpmd5
 .endif
 .endif