diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index b92f770018ac4..85347c24418fe 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -30,13 +30,17 @@
 , libxcrypt
 , hostname
 , nixosTests
-, withFIDO ? stdenv.hostPlatform.isUnix && !stdenv.hostPlatform.isMusl
+, withSecurityKey ? !stdenv.hostPlatform.isStatic
+, withFIDO ? stdenv.hostPlatform.isUnix && !stdenv.hostPlatform.isMusl && withSecurityKey
 , withPAM ? stdenv.hostPlatform.isLinux
 , dsaKeysSupport ? false
 , linkOpenssl ? true
 , isNixos ? stdenv.hostPlatform.isLinux
 }:
 
+# FIDO support requires SK support
+assert withFIDO -> withSecurityKey;
+
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version src;
 
@@ -103,6 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.withFeature withPAM "pam")
     (lib.enableFeature dsaKeysSupport "dsa-keys")
   ] ++ lib.optional (etcDir != null) "--sysconfdir=${etcDir}"
+    ++ lib.optional (!withSecurityKey) "--disable-security-key"
     ++ lib.optional withFIDO "--with-security-key-builtin=yes"
     ++ lib.optional withKerberos (assert krb5 != null; "--with-kerberos5=${lib.getDev krb5}")
     ++ lib.optional stdenv.hostPlatform.isDarwin "--disable-libutil"
@@ -110,7 +115,9 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withLdns "--with-ldns"
     ++ extraConfigureFlags;
 
-  ${if stdenv.hostPlatform.isStatic then "NIX_LDFLAGS" else null}= [ "-laudit" ] ++ lib.optionals withKerberos [ "-lkeyutils" ];
+  ${if stdenv.hostPlatform.isStatic then "NIX_LDFLAGS" else null} = [ "-laudit" ]
+    ++ lib.optional withKerberos "-lkeyutils"
+    ++ lib.optional withLdns "-lcrypto";
 
   buildFlags = [ "SSH_KEYSIGN=ssh-keysign" ];