diff --git a/g10/Makefile.am b/g10/Makefile.am
index ea4afc878..0c53eab97 100644
--- a/g10/Makefile.am
+++ b/g10/Makefile.am
@@ -25,9 +25,7 @@ AM_CPPFLAGS = -I$(top_srcdir)/common
 
 include $(top_srcdir)/am/cmacros.am
 
-# We need KSBA_CFLAGS because that is included by keybox.h.  See also
-# comments below for libksba.
-AM_CFLAGS = $(LIBGCRYPT_CFLAGS) $(KSBA_CFLAGS) \
+AM_CFLAGS = $(LIBGCRYPT_CFLAGS) \
             $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS)
 
 needed_libs = ../kbx/libkeybox.a $(libcommon)
@@ -140,17 +138,14 @@ gpgv2_SOURCES = gpgv.c           \
 #	       ks-db.h \
 #	       $(common_source)
 
-# FIXME: Libkeybox.a links to libksba thus we need to add libksba
-# here, even that it is not used by gpg.  A proper solution would
-# either to split up libkeybox.a or to use a separate keybox daemon.
 LDADD =  $(needed_libs) ../common/libgpgrl.a \
          $(ZLIBS) $(LIBINTL) $(CAPLIBS) $(NETLIBS)
 gpg2_LDADD = $(LDADD) $(LIBGCRYPT_LIBS) $(LIBREADLINE) \
-             $(KSBA_LIBS) $(LIBASSUAN_LIBS) $(GPG_ERROR_LIBS) \
+             $(LIBASSUAN_LIBS) $(GPG_ERROR_LIBS) \
 	     $(LIBICONV) $(resource_objs) $(extra_sys_libs)
 gpg2_LDFLAGS = $(extra_bin_ldflags)
 gpgv2_LDADD = $(LDADD) $(LIBGCRYPT_LIBS) \
-              $(KSBA_LIBS) $(GPG_ERROR_LIBS) \
+              $(GPG_ERROR_LIBS) \
 	      $(LIBICONV) $(resource_objs) $(extra_sys_libs)
 gpgv2_LDFLAGS = $(extra_bin_ldflags)
 
diff --git a/kbx/Makefile.am b/kbx/Makefile.am
index 5df2bbaef..95138e043 100644
--- a/kbx/Makefile.am
+++ b/kbx/Makefile.am
@@ -26,7 +26,7 @@ include $(top_srcdir)/am/cmacros.am
 
 AM_CFLAGS = $(LIBGCRYPT_CFLAGS) $(KSBA_CFLAGS)
 
-noinst_LIBRARIES = libkeybox.a
+noinst_LIBRARIES = libkeybox.a libkeybox509.a
 bin_PROGRAMS = kbxutil
 
 if HAVE_W32CE_SYSTEM
@@ -48,11 +48,17 @@ common_sources = \
 
 
 libkeybox_a_SOURCES = $(common_sources)
+libkeybox509_a_SOURCES = $(common_sources)
+
+libkeybox_a_CFLAGS = $(AM_CFLAGS)
+libkeybox509_a_CFLAGS = $(AM_CFLAGS) -DKEYBOX_WITH_X509=1
+
 
 # We need W32SOCKLIBS because the init subsystem code in libcommon
 # requires it - although we don't actually need it.  It is easier
 # to do it this way.
 kbxutil_SOURCES = kbxutil.c $(common_sources)
+kbxutil_CFLAGS = $(AM_CFLAGS) -DKEYBOX_WITH_X509=1
 kbxutil_LDADD   = ../common/libcommon.a \
                   $(KSBA_LIBS) $(LIBGCRYPT_LIBS) $(extra_libs) \
                   $(GPG_ERROR_LIBS) $(LIBINTL) $(LIBICONV) $(W32SOCKLIBS)
diff --git a/kbx/keybox-search.c b/kbx/keybox-search.c
index 1433591c1..05b6859d2 100644
--- a/kbx/keybox-search.c
+++ b/kbx/keybox-search.c
@@ -611,6 +611,9 @@ has_keygrip (KEYBOXBLOB blob, const unsigned char *grip)
 #ifdef KEYBOX_WITH_X509
   if (blob_get_type (blob) == KEYBOX_BLOBTYPE_X509)
     return blob_x509_has_grip (blob, grip);
+#else
+  (void)blob;
+  (void)grip;
 #endif
   return 0;
 }
diff --git a/kbx/keybox.h b/kbx/keybox.h
index 386fff1e6..8c3114142 100644
--- a/kbx/keybox.h
+++ b/kbx/keybox.h
@@ -29,9 +29,6 @@ extern "C" {
 #include "../common/iobuf.h"
 #include "keybox-search-desc.h"
 
-#define KEYBOX_WITH_X509 1
-
-
 #ifdef KEYBOX_WITH_X509
 # include <ksba.h>
 #endif
diff --git a/sm/Makefile.am b/sm/Makefile.am
index dda3eb8d1..43e3598bd 100644
--- a/sm/Makefile.am
+++ b/sm/Makefile.am
@@ -23,7 +23,7 @@ bin_PROGRAMS = gpgsm
 
 AM_CFLAGS = $(LIBGCRYPT_CFLAGS) $(KSBA_CFLAGS) $(LIBASSUAN_CFLAGS)
 
-AM_CPPFLAGS = -I$(top_srcdir)/common
+AM_CPPFLAGS = -I$(top_srcdir)/common -DKEYBOX_WITH_X509=1
 include $(top_srcdir)/am/cmacros.am
 
 if HAVE_W32_SYSTEM
@@ -57,7 +57,7 @@ gpgsm_SOURCES = \
 	qualified.c
 
 
-common_libs = ../kbx/libkeybox.a $(libcommon)
+common_libs = ../kbx/libkeybox509.a $(libcommon)
 
 gpgsm_LDADD = $(common_libs) ../common/libgpgrl.a \
               $(LIBGCRYPT_LIBS) $(KSBA_LIBS) $(LIBASSUAN_LIBS) \