diff --git a/package/p11-kit/p11-kit.mk b/package/p11-kit/p11-kit.mk
index c2a7b23e9d..1ffc7e21c8 100644
--- a/package/p11-kit/p11-kit.mk
+++ b/package/p11-kit/p11-kit.mk
@@ -13,12 +13,6 @@ P11_KIT_CONF_ENV = ac_cv_have_decl_program_invocation_short_name=yes \
 P11_KIT_LICENSE = BSD-3-Clause
 P11_KIT_LICENSE_FILES = COPYING
 
-ifeq ($(BR2_PACKAGE_CA_CERTIFICATES),y)
-P11_KIT_CONF_OPTS += --with-trust-paths=/etc/ssl/certs/ca-certificates.crt
-else
-P11_KIT_CONF_OPTS += --without-trust-paths
-endif
-
 ifeq ($(BR2_PACKAGE_LIBFFI),y)
 P11_KIT_DEPENDENCIES += host-pkgconf libffi
 P11_KIT_CONF_OPTS += --with-libffi
@@ -28,9 +22,18 @@ endif
 
 ifeq ($(BR2_PACKAGE_LIBTASN1),y)
 P11_KIT_DEPENDENCIES += host-pkgconf libtasn1
-P11_KIT_CONF_OPTS += --with-libtasn1
+P11_KIT_CONF_OPTS += \
+	--enable-trust-module \
+	--with-libtasn1
+ifeq ($(BR2_PACKAGE_CA_CERTIFICATES),y)
+P11_KIT_CONF_OPTS += --with-trust-paths=/etc/ssl/certs/ca-certificates.crt
 else
-P11_KIT_CONF_OPTS += --without-libtasn1
+P11_KIT_CONF_OPTS += --without-trust-paths
+endif
+else
+P11_KIT_CONF_OPTS += \
+	--disable-trust-module \
+	--without-libtasn1
 endif
 
 $(eval $(autotools-package))