diff --git a/usr.sbin/wpa/Makefile.inc b/usr.sbin/wpa/Makefile.inc
index 915b5312f02f..e43a6f539d92 100644
--- a/usr.sbin/wpa/Makefile.inc
+++ b/usr.sbin/wpa/Makefile.inc
@@ -56,7 +56,6 @@ CFLAGS+=-DCONFIG_TDLS
 CFLAGS+=-DCONFIG_TERMINATE_ONLASTIF
 CFLAGS+=-DCONFIG_TLS=openssl
 CFLAGS+=-DCONFIG_MATCH_IFACE
-CFLAGS+=-DCONFIG_PASN
 CFLAGS+=-DCONFIG_PTKSA_CACHE
 CFLAGS+=-DEAP_SERVER
 CFLAGS+=-DEAP_SERVER_GTC
@@ -91,6 +90,10 @@ NEED_AES_ENCBLOCK=y
 NEED_AES_OMAC1=y
 .endif
 
+.if ${MK_CRYPT} != "no"
+CFLAGS+=-DCONFIG_PASN
+.endif
+
 .if !empty(CFLAGS:M*-DEAP_AKA)
 NEED_SIM_COMMON=y
 NEED_AES_CBC=y