diff --git a/kerberos5/usr.bin/ksu/Makefile b/kerberos5/usr.bin/ksu/Makefile
--- a/kerberos5/usr.bin/ksu/Makefile
+++ b/kerberos5/usr.bin/ksu/Makefile
@@ -1,10 +1,8 @@
 PACKAGE=	kerberos
 
 PROG=	ksu
-.if defined(ENABLE_SUID_K5SU)
 BINMODE=4555
 PRECIOUSPROG=
-.endif
 MAN=
 SRCS=	su.c
 CFLAGS+=-I${KRB5DIR}/lib/roken
diff --git a/krb5/usr.bin/ksu/Makefile b/krb5/usr.bin/ksu/Makefile
--- a/krb5/usr.bin/ksu/Makefile
+++ b/krb5/usr.bin/ksu/Makefile
@@ -8,10 +8,8 @@
 #
 
 PROG=	ksu
-.if defined(ENABLE_SUID_K5SU)
 BINMODE=4555
 PRECIOUSPROG=
-.endif
 
 LIBADD=	krb5 k5crypto com_err krb5profile krb5support sys
 
diff --git a/share/examples/etc/make.conf b/share/examples/etc/make.conf
--- a/share/examples/etc/make.conf
+++ b/share/examples/etc/make.conf
@@ -179,12 +179,6 @@
 #LOADER_TFTP_SUPPORT= YES
 #
 #
-# Kerberos 5 su (k5su)
-# If you want to use the k5su utility, define this to have it installed
-# set-user-ID.
-#ENABLE_SUID_K5SU=
-#
-#
 # top(1) uses a hash table for the user names.  The size of this hash
 # can be tuned to match the number of local users.  The table size should
 # be a prime number approximately twice as large as the number of lines in
diff --git a/share/man/man5/make.conf.5 b/share/man/man5/make.conf.5
--- a/share/man/man5/make.conf.5
+++ b/share/man/man5/make.conf.5
@@ -347,11 +347,6 @@
 option in
 .Xr boot 8
 blocks.
-.It Va ENABLE_SUID_K5SU
-.Pq Vt bool
-Set this if you wish to use the ksu utility.
-Otherwise, it will be
-installed without the set-user-ID bit set.
 .It Va ENABLE_SUID_NEWGRP
 .Pq Vt bool
 Set this to install