diff --git a/net/bind/Config.in b/net/bind/Config.in
index 07bcc1c63..f1b83c746 100644
--- a/net/bind/Config.in
+++ b/net/bind/Config.in
@@ -33,4 +33,12 @@ config BIND_ENABLE_DOH
 		You can disable DoHTTPS if you do not need it or need
 		to avoid the additional library dependency.
 
+config BIND_ENABLE_GSSAPI
+	bool
+	default n
+	prompt "Include GSSPAI support in bind"
+	help
+		BIND 9 supports GSSAPI. This depends on libcomerr and krb5-libs.
+		Disable it by default as krb5-libs is rather large.
+
 endif
diff --git a/net/bind/Makefile b/net/bind/Makefile
index 5f753ddc8..9f49d7ee5 100644
--- a/net/bind/Makefile
+++ b/net/bind/Makefile
@@ -34,7 +34,8 @@ PKG_BUILD_PARALLEL:=1
 PKG_CONFIG_DEPENDS := \
 	CONFIG_BIND_LIBJSON \
 	CONFIG_BIND_LIBXML2 \
-	CONFIG_BIND_ENABLE_DOH
+	CONFIG_BIND_ENABLE_DOH \
+	CONFIG_BIND_ENABLE_GSSAPI
 
 PKG_BUILD_DEPENDS += BIND_LIBXML2:libxml2 BIND_LIBJSON:libjson-c
 
@@ -61,6 +62,8 @@ define Package/bind-libs
 	+libatomic \
 	+libuv \
 	+BIND_ENABLE_DOH:libnghttp2 \
+	+BIND_ENABLE_GSSAPI:krb5-libs \
+	+BIND_ENABLE_GSSAPI:libcomerr \
 	+BIND_LIBXML2:libxml2 \
 	+BIND_LIBJSON:libjson-c
   TITLE:=bind shared libraries
@@ -147,7 +150,6 @@ CONFIGURE_ARGS += \
 	--with-openssl="$(STAGING_DIR)/usr" \
 	--without-lmdb \
 	--enable-epoll \
-	--without-gssapi \
 	--without-readline \
 	--sysconfdir=/etc/bind
 
@@ -176,6 +178,14 @@ else
 		--disable-doh
 endif
 
+ifdef CONFIG_BIND_ENABLE_GSSAPI
+	CONFIGURE_ARGS += \
+		--with-gssapi
+else
+	CONFIGURE_ARGS += \
+		--without-gssapi
+endif
+
 CONFIGURE_VARS += \
 	BUILD_CC="$(TARGET_CC)" \