diff --git a/src/shared/openssl-util.h b/src/shared/openssl-util.h
index dcb9c9ffa6..a7dab530e4 100644
--- a/src/shared/openssl-util.h
+++ b/src/shared/openssl-util.h
@@ -1,9 +1,12 @@
 /* SPDX-License-Identifier: LGPL-2.1+ */
 #pragma once
 
-#include <openssl/pem.h>
+#if HAVE_OPENSSL
+#  include <openssl/pem.h>
 
 DEFINE_TRIVIAL_CLEANUP_FUNC(X509*, X509_free);
 DEFINE_TRIVIAL_CLEANUP_FUNC(X509_NAME*, X509_NAME_free);
 DEFINE_TRIVIAL_CLEANUP_FUNC(EVP_PKEY_CTX*, EVP_PKEY_CTX_free);
 DEFINE_TRIVIAL_CLEANUP_FUNC(EVP_CIPHER_CTX*, EVP_CIPHER_CTX_free);
+
+#endif
diff --git a/src/shared/pkcs11-util.h b/src/shared/pkcs11-util.h
index 42f461d371..46791eb23b 100644
--- a/src/shared/pkcs11-util.h
+++ b/src/shared/pkcs11-util.h
@@ -4,15 +4,12 @@
 #include <stdbool.h>
 
 #if HAVE_P11KIT
-#include <p11-kit/p11-kit.h>
-#include <p11-kit/uri.h>
-
-#if HAVE_OPENSSL
-#include <openssl/pem.h>
-#endif
+#  include <p11-kit/p11-kit.h>
+#  include <p11-kit/uri.h>
 #endif
 
 #include "macro.h"
+#include "openssl-util.h"
 #include "time-util.h"
 
 bool pkcs11_uri_valid(const char *uri);