diff --git a/qemu/Makefile b/qemu/Makefile
index b9a8f309..ffa8e517 100644
--- a/qemu/Makefile
+++ b/qemu/Makefile
@@ -106,6 +106,8 @@ dummy := $(call unnest-vars,, \
                 util-obj-y \
                 block-obj-y \
                 block-obj-m \
+                crypto-obj-y \
+                crypto-aes-obj-y \
                 common-obj-y \
                 common-obj-m)
 
@@ -118,6 +120,7 @@ SUBDIR_RULES=$(patsubst %,subdir-%, $(TARGET_DIRS))
 SOFTMMU_SUBDIR_RULES=$(filter %-softmmu,$(SUBDIR_RULES))
 
 $(SOFTMMU_SUBDIR_RULES): $(block-obj-y)
+$(SOFTMMU_SUBDIR_RULES): $(crypto-obj-y)
 $(SOFTMMU_SUBDIR_RULES): config-all-devices.mak
 
 subdir-%:
diff --git a/qemu/Makefile.objs b/qemu/Makefile.objs
index e23f884f..f4e3193b 100644
--- a/qemu/Makefile.objs
+++ b/qemu/Makefile.objs
@@ -1,7 +1,6 @@
 #######################################################################
 # Common libraries for tools and emulators
 util-obj-y = util/ qobject/ qapi/ qapi-types.o qapi-visit.o
-util-obj-y += crypto/
 
 #######################################################################
 # block-obj-y is code used by both qemu system emulation and qemu-img
@@ -9,6 +8,12 @@ util-obj-y += crypto/
 block-obj-y =
 block-obj-y += ../uc.o ../list.o glib_compat.o
 
+#######################################################################
+# crypto-obj-y is code used by both qemu system emulation and qemu-img
+
+crypto-obj-y = crypto/
+crypto-aes-obj-y = crypto/
+
 #######################################################################
 # Target independent part of system emulation. The long term path is to
 # suppress *all* target specific code in case of system emulation, i.e. a
diff --git a/qemu/Makefile.target b/qemu/Makefile.target
index b9c1a3d1..83490caf 100644
--- a/qemu/Makefile.target
+++ b/qemu/Makefile.target
@@ -79,7 +79,9 @@ target-obj-y-save := $(target-obj-y) $(util-obj-y)
 
 dummy := $(call unnest-vars,.., \
                block-obj-y \
-               block-obj-m)
+               block-obj-m \
+               crypto-obj-y \
+               crypto-aes-obj-y)
 
 dummy := $(call unnest-vars,..,common-obj-y,common-obj-m)
 
@@ -87,6 +89,8 @@ target-obj-y := $(target-obj-y-save)
 all-obj-y += $(common-obj-y)
 all-obj-y += $(target-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(block-obj-y)
+all-obj-$(CONFIG_USER_ONLY) += $(crypto-aes-obj-y)
+all-obj-$(CONFIG_SOFTMMU) += $(crypto-obj-y)
 
 # determine shared lib extension
 IS_APPLE := $(shell $(CC) -dM -E - < /dev/null | grep __apple_build_version__ | wc -l | tr -d " ")
diff --git a/qemu/crypto/Makefile.objs b/qemu/crypto/Makefile.objs
index a9363537..b7d048e8 100644
--- a/qemu/crypto/Makefile.objs
+++ b/qemu/crypto/Makefile.objs
@@ -1,3 +1,6 @@
-util-obj-y = init.o
-util-obj-y += hash.o
-util-obj-y += aes.o
\ No newline at end of file
+crypto-obj-y = init.o
+crypto-obj-y += hash.o
+crypto-obj-y += aes.o
+
+# Let the userspace emulators avoid linking gnutls/etc
+crypto-aes-obj-y = aes.o