Index: secure/lib/libssh/Makefile
===================================================================
--- secure/lib/libssh/Makefile
+++ secure/lib/libssh/Makefile
@@ -4,29 +4,26 @@
 LIB=	ssh
 PRIVATELIB=	true
 SHLIB_MAJOR=	5
-SRCS=	ssh_api.c ssherr.c \
-	sshbuf.c sshkey.c sshbuf-getput-basic.c \
-	sshbuf-misc.c sshbuf-getput-crypto.c krl.c bitmap.c
-SRCS+=	authfd.c authfile.c \
-	canohost.c channels.c cipher.c cipher-aes.c cipher-aesctr.c \
+SRCS=	ssh_api.c
+SRCS+=	authfd.c \
+	cipher-aes.c \
 	cleanup.c \
 	compat.c fatal.c hostfile.c \
-	log.c match.c moduli.c nchan.c packet.c \
-	readpass.c ttymodes.c xmalloc.c addr.c addrmatch.c \
-	atomicio.c dispatch.c mac.c misc.c utf8.c \
-	monitor_fdpass.c rijndael.c ssh-dss.c ssh-ecdsa.c ssh-ecdsa-sk.c \
-	ssh-ed25519-sk.c ssh-rsa.c dh.c \
-	msg.c dns.c entropy.c umac.c umac128.c \
-	ssh-pkcs11.c smult_curve25519_ref.c \
-	poly1305.c chacha.c cipher-chachapoly.c cipher-chachapoly-libcrypto.c \
-	ssh-ed25519.c digest-openssl.c digest-libc.c \
-	hmac.c ed25519.c hash.c \
-	kex.c kexdh.c kexgex.c kexecdh.c kexc25519.c \
-	kexgexc.c kexgexs.c \
-	kexsntrup761x25519.c sntrup761.c kexgen.c \
-	sftp-realpath.c platform-pledge.c platform-tracing.c platform-misc.c \
-	sshbuf-io.c
-SRCS+=	ssh-sk-client.c
+	dns.c entropy.c \
+	readpass.c \
+	utf8.c \
+	sftp-realpath.c platform-pledge.c platform-tracing.c platform-misc.c
+SRCS+=	${SRCS_BASE}
+SRCS+=	${SRCS_KEX} ${SRCS_KEXC} ${SRCS_KEXS}
+SRCS+=	${SRCS_KEY}
+SRCS+=	${SRCS_KEYP}
+SRCS+=	${SRCS_KRL}
+SRCS+=	${SRCS_MAC}
+SRCS+=	${SRCS_PKT}
+SRCS+=	${SRCS_PROT}
+SRCS+=	${SRCS_PKCS11}
+SRCS+=	${SRCS_MODULI}
+SRCS+=	${SRCS_SK_CLIENT}
 
 PACKAGE=	ssh
 
Index: secure/libexec/ssh-pkcs11-helper/Makefile
===================================================================
--- secure/libexec/ssh-pkcs11-helper/Makefile
+++ secure/libexec/ssh-pkcs11-helper/Makefile
@@ -2,7 +2,7 @@
 .include "${SRCTOP}/secure/ssh.mk"
 
 PROG=	ssh-pkcs11-helper
-SRCS=	ssh-pkcs11.c ssh-pkcs11-helper.c
+SRCS=	ssh-pkcs11-helper.c ${SRCS_PKCS11}
 MAN=	ssh-pkcs11-helper.8
 
 LIBADD=	ssh
Index: secure/libexec/ssh-sk-helper/Makefile
===================================================================
--- secure/libexec/ssh-sk-helper/Makefile
+++ secure/libexec/ssh-sk-helper/Makefile
@@ -2,7 +2,9 @@
 .include "${SRCTOP}/secure/ssh.mk"
 
 PROG=	ssh-sk-helper
-SRCS=	ssh-sk-helper.c ssh-sk.c sk-usbhid.c
+SRCS=	ssh-sk-helper.c
+SRCS+=	${SRCS_SK}
+
 MAN=	ssh-sk-helper.8
 CFLAGS+=-I${SRCTOP}/contrib/libfido2/src
 
Index: secure/ssh.mk
===================================================================
--- secure/ssh.mk
+++ secure/ssh.mk
@@ -11,3 +11,77 @@
 # Built-in security key support
 CFLAGS+= -include sk_config.h
 .endif
+
+SRCS_BASE+=	sshbuf.c
+SRCS_BASE+=	sshbuf-getput-basic.c
+SRCS_BASE+=	sshbuf-misc.c
+SRCS_BASE+=	ssherr.c
+SRCS_BASE+=	log.c
+SRCS_BASE+=	xmalloc.c
+SRCS_BASE+=	misc.c
+SRCS_BASE+=	addr.c
+SRCS_BASE+=	addrmatch.c
+SRCS_BASE+=	match.c
+
+SRCS_KEX+=	dh.c
+SRCS_KEX+=	kexdh.c
+SRCS_KEX+=	kexecdh.c
+SRCS_KEX+=	kexgex.c
+SRCS_KEXC+=	kexgexc.c
+SRCS_KEXS+=	kexgexs.c
+SRCS_KEX+=	kexc25519.c
+SRCS_KEX+=	smult_curve25519_ref.c
+SRCS_KEX+=	kexgen.c
+SRCS_KEX+=	kexsntrup761x25519.c
+SRCS_KEX+=	sntrup761.c
+
+SRCS_KEY+=	sshkey.c
+SRCS_KEY+=	cipher.c
+SRCS_KEY+=	chacha.c
+SRCS_KEY+=	poly1305.c
+SRCS_KEY+=	ssh-ecdsa.c
+SRCS_KEY+=	ssh-ecdsa-sk.c
+SRCS_KEY+=	ssh-rsa.c
+SRCS_KEY+=	ssh-dss.c
+SRCS_KEY+=	sshbuf-getput-crypto.c
+SRCS_KEY+=	digest-openssl.c
+SRCS_KEY+=	cipher-chachapoly-libcrypto.c
+SRCS_KEY+=	cipher-aesctr.c
+SRCS_KEY+=	rijndael.c
+SRCS_KEY+=	digest-libc.c
+SRCS_KEY+=	cipher-chachapoly.c
+SRCS_KEY+=	ssh-ed25519.c
+SRCS_KEY+=	ssh-ed25519-sk.c
+SRCS_KEY+=	ed25519.c
+SRCS_KEY+=	hash.c
+
+SRCS_KEYP+=	authfile.c
+SRCS_KEYP+=	sshbuf-io.c
+SRCS_KEYP+=	atomicio.c
+
+SRCS_KRL+=	bitmap.c
+SRCS_KRL+=	krl.c
+
+SRCS_MAC+=	mac.c
+SRCS_MAC+=	hmac.c
+SRCS_MAC+=	umac.c
+SRCS_MAC+=	umac128.c
+
+SRCS_PKT+=	canohost.c
+SRCS_PKT+=	dispatch.c
+SRCS_PKT+=	kex.c
+SRCS_PKT+=	packet.c
+
+SRCS_PROT+=	channels.c
+SRCS_PROT+=	monitor_fdpass.c
+SRCS_PROT+=	nchan.c
+SRCS_PROT+=	ttymodes.c
+
+SRCS_PKCS11+=		ssh-pkcs11.c
+SRCS_PKCS11_CLIENT+=	ssh-pkcs11-client.c
+SRCS_MODULI+=		moduli.c
+
+SRCS_SK=		ssh-sk.c
+SRCS_SK+=		sk-usbhid.c
+SRCS_SK_CLIENT=		ssh-sk-client.c
+SRCS_SK_CLIENT+=	msg.c
Index: secure/usr.bin/sftp/Makefile
===================================================================
--- secure/usr.bin/sftp/Makefile
+++ secure/usr.bin/sftp/Makefile
@@ -2,8 +2,8 @@
 .include "${SRCTOP}/secure/ssh.mk"
 
 PROG=	sftp
-SRCS=   sftp.c sftp-client.c sftp-common.c sftp-glob.c sftp-usergroup.c \
-	progressmeter.c
+SRCS=   sftp.c sftp-client.c sftp-common.c sftp-glob.c sftp-usergroup.c
+SRCS+=	progressmeter.c
 PACKAGE=	ssh
 
 LIBADD=	ssh edit
Index: secure/usr.bin/ssh-add/Makefile
===================================================================
--- secure/usr.bin/ssh-add/Makefile
+++ secure/usr.bin/ssh-add/Makefile
@@ -2,7 +2,8 @@
 .include "${SRCTOP}/secure/ssh.mk"
 
 PROG=	ssh-add
-SRCS+=	ssh-add.c ssh-sk-client.c
+SRCS+=	ssh-add.c
+SRCS+=	${SRCS_SK_CLIENT}
 PACKAGE=	ssh
 
 LIBADD=	ssh
Index: secure/usr.bin/ssh-agent/Makefile
===================================================================
--- secure/usr.bin/ssh-agent/Makefile
+++ secure/usr.bin/ssh-agent/Makefile
@@ -2,7 +2,7 @@
 .include "${SRCTOP}/secure/ssh.mk"
 
 PROG=	ssh-agent
-SRCS=	ssh-agent.c ssh-pkcs11-client.c
+SRCS=	ssh-agent.c ${SRCS_PKCS11_CLIENT}
 PACKAGE=	ssh
 
 LIBADD=	ssh
Index: secure/usr.bin/ssh-keygen/Makefile
===================================================================
--- secure/usr.bin/ssh-keygen/Makefile
+++ secure/usr.bin/ssh-keygen/Makefile
@@ -2,8 +2,7 @@
 .include "${SRCTOP}/secure/ssh.mk"
 
 PROG=	ssh-keygen
-# XXX ssh-sk-client.c in libssh maybe?
-SRCS=	ssh-keygen.c sshsig.c ssh-sk-client.c
+SRCS=	ssh-keygen.c sshsig.c ${SSH_SK_CLIENT}
 PACKAGE=	ssh
 
 LIBADD=	ssh
Index: secure/usr.bin/ssh/Makefile
===================================================================
--- secure/usr.bin/ssh/Makefile
+++ secure/usr.bin/ssh/Makefile
@@ -9,8 +9,7 @@
 MLINKS=	ssh.1 slogin.1
 PACKAGE=	ssh
 
-SRCS=	ssh.c readconf.c clientloop.c sshtty.c \
-	sshconnect.c sshconnect2.c mux.c
+SRCS=	ssh.c readconf.c clientloop.c sshtty.c sshconnect.c sshconnect2.c mux.c
 
 # gss-genr.c really belongs in libssh; see src/secure/lib/libssh/Makefile
 SRCS+=	gss-genr.c