diff --git a/dirmngr/Makefile.am b/dirmngr/Makefile.am
index f56e59a3e..d154e5228 100644
--- a/dirmngr/Makefile.am
+++ b/dirmngr/Makefile.am
@@ -1,183 +1,183 @@
 # Makefile.am - dirmngr
 # Copyright (C) 2002 Klarälvdalens Datakonsult AB
 # Copyright (C) 2004, 2007, 2010 g10 Code GmbH
 #
 # This file is part of GnuPG.
 #
 # GnuPG is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # GnuPG is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, see <https://www.gnu.org/licenses/>.
 #
 # SPDX-License-Identifier: GPL-3.0+
 
 ## Process this file with automake to produce Makefile.in
 
 EXTRA_DIST = OAUTHORS ONEWS ChangeLog-2011 tls-ca.pem
 dist_pkgdata_DATA = sks-keyservers.netCA.pem
 
 bin_PROGRAMS = dirmngr dirmngr-client
 
 if USE_LDAP
 libexec_PROGRAMS = dirmngr_ldap
 else
 libexec_PROGRAMS =
 endif
 
 noinst_PROGRAMS = $(module_tests) $(module_net_tests) $(module_maint_tests)
 if DISABLE_TESTS
 TESTS =
 else
 TESTS = $(module_tests) $(module_net_tests)
 endif
 
 AM_CPPFLAGS =
 
 include $(top_srcdir)/am/cmacros.am
 
 AM_CFLAGS = $(USE_C99_CFLAGS) \
             $(LIBGCRYPT_CFLAGS) $(KSBA_CFLAGS) $(LIBASSUAN_CFLAGS)	\
             $(GPG_ERROR_CFLAGS) $(NPTH_CFLAGS) $(NTBTLS_CFLAGS)		\
             $(LIBGNUTLS_CFLAGS)
 
 
 if HAVE_W32_SYSTEM
 ldap_url = ldap-url.h ldap-url.c
 else
 ldap_url =
 endif
 
 noinst_HEADERS = dirmngr.h crlcache.h crlfetch.h misc.h
 
 dirmngr_SOURCES = dirmngr.c dirmngr.h server.c crlcache.c crlfetch.c	\
 	certcache.c certcache.h \
 	domaininfo.c \
 	workqueue.c \
 	loadswdb.c \
 	cdb.h cdblib.c misc.c dirmngr-err.h dirmngr-status.h \
 	ocsp.c ocsp.h validate.c validate.h  \
 	dns-stuff.c dns-stuff.h \
 	http.c http.h http-common.c http-common.h http-ntbtls.c \
 	ks-action.c ks-action.h ks-engine.h \
 	ks-engine-hkp.c ks-engine-http.c ks-engine-finger.c ks-engine-kdns.c
 
 if USE_LIBDNS
 dirmngr_SOURCES += dns.c dns.h
 endif
 
 if USE_LDAP
 dirmngr_SOURCES += ldapserver.h ldapserver.c ldap.c w32-ldap-help.h \
                    ldap-wrapper.h ldap-parse-uri.c ldap-parse-uri.h \
                    ldap-misc.c ldap-misc.h \
                    ks-engine-ldap.c $(ldap_url) ldap-wrapper.c
 ldaplibs = $(LDAPLIBS)
 else
 ldaplibs =
 endif
 
 
 dirmngr_LDADD = $(libcommonpth) \
         $(DNSLIBS) $(LIBASSUAN_LIBS) \
 	$(LIBGCRYPT_LIBS) $(KSBA_LIBS) $(NPTH_LIBS) \
 	$(NTBTLS_LIBS) $(LIBGNUTLS_LIBS) $(LIBINTL) $(LIBICONV) $(NETLIBS)
 if USE_LDAP
 dirmngr_LDADD += $(ldaplibs)
 endif
 dirmngr_LDFLAGS = $(extra_bin_ldflags)
 
 if USE_LDAP
 dirmngr_ldap_SOURCES = dirmngr_ldap.c ldap-misc.c ldap-misc.h $(ldap_url)
 dirmngr_ldap_CFLAGS = $(GPG_ERROR_CFLAGS) $(LIBGCRYPT_CFLAGS)
 dirmngr_ldap_LDFLAGS =
 dirmngr_ldap_LDADD = $(libcommon) \
 		     $(GPG_ERROR_LIBS) $(LIBGCRYPT_LIBS) $(LDAPLIBS) \
 		     $(LBER_LIBS) $(LIBINTL) $(LIBICONV) $(NETLIBS)
 endif
 
 dirmngr_client_SOURCES = dirmngr-client.c
 dirmngr_client_LDADD = $(libcommon) \
                        $(LIBASSUAN_LIBS) $(GPG_ERROR_LIBS) \
                        $(LIBGCRYPT_LIBS) $(NETLIBS) $(LIBINTL) $(LIBICONV)
 dirmngr_client_LDFLAGS = $(extra_bin_ldflags)
 
 
 t_common_src = t-support.h t-support.c
 if USE_LIBDNS
 t_common_src += dns.c dns.h
 endif
 t_common_ldadd = $(libcommon) $(LIBASSUAN_LIBS) $(LIBGCRYPT_LIBS) \
                  $(GPG_ERROR_LIBS) $(NETLIBS) \
                  $(NTBTLS_LIBS) $(LIBGNUTLS_LIBS) \
                  $(DNSLIBS) $(LIBINTL) $(LIBICONV)
 
 module_tests = t-http-basic
 
 if USE_LDAP
 module_tests += t-ldap-parse-uri t-ldap-misc
 endif
 
 # Test which need a network connections are only used in maintainer mode.
 if MAINTAINER_MODE
 module_net_tests = t-dns-stuff
 else
 module_net_tests =
 endif
 
 # Tests which are only for manually testing are only build in maintainer-mode.
 if MAINTAINER_MODE
 module_maint_tests = t-http
 else
 module_maint_tests =
 endif
 
 
 # http tests
 # We need to add the KSBA flags in case we are building against GNUTLS.
 # In that case NTBTLS flags are empty, but we need ksba anyway.
 t_http_SOURCES = $(t_common_src) t-http.c http.c dns-stuff.c http-common.c
 t_http_CFLAGS  = -DWITHOUT_NPTH=1  $(USE_C99_CFLAGS) \
 	         $(LIBGCRYPT_CFLAGS) $(NTBTLS_CFLAGS) $(LIBGNUTLS_CFLAGS) \
                  $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS) $(KSBA_CFLAGS)
 t_http_LDADD   = $(t_common_ldadd) \
 	         $(NTBTLS_LIBS) $(KSBA_LIBS) $(LIBGNUTLS_LIBS) $(DNSLIBS)
 
 t_http_basic_SOURCES = $(t_common_src) t-http-basic.c http.c \
 	               dns-stuff.c http-common.c
 t_http_basic_CFLAGS  = -DWITHOUT_NPTH=1  $(USE_C99_CFLAGS) \
 	         $(LIBGCRYPT_CFLAGS) $(NTBTLS_CFLAGS) $(LIBGNUTLS_CFLAGS) \
                  $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS) $(KSBA_CFLAGS)
 t_http_basic_LDADD   = $(t_common_ldadd) \
 	         $(NTBTLS_LIBS) $(KSBA_LIBS) $(LIBGNUTLS_LIBS) $(DNSLIBS)
 
 t_ldap_parse_uri_SOURCES = \
 	t-ldap-parse-uri.c ldap-parse-uri.c ldap-parse-uri.h \
         http.c http-common.c dns-stuff.c ldap-misc.c \
         $(ldap_url) $(t_common_src)
 t_ldap_parse_uri_CFLAGS = -DWITHOUT_NPTH=1  $(USE_C99_CFLAGS) \
 			  $(LIBGCRYPT_CFLAGS) \
-                          $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS)
+                          $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS) $(KSBA_CFLAGS)
 t_ldap_parse_uri_LDADD = $(ldaplibs) $(t_common_ldadd) $(DNSLIBS)
 
 t_ldap_misc_SOURCES = t-ldap-misc.c ldap-misc.c ldap-misc.h $(ldap_url)
 t_ldap_misc_CFLAGS = -DWITHOUT_NPTH=1 $(GPG_ERROR_CFLAGS) $(LIBGCRYPT_CFLAGS)
 t_ldap_misc_LDFLAGS =
 t_ldap_misc_LDADD = $(libcommon) \
 		     $(GPG_ERROR_LIBS) $(LIBGCRYPT_LIBS) $(LDAPLIBS) \
 		     $(LBER_LIBS) $(LIBINTL) $(LIBICONV) $(NETLIBS)
 
 
 t_dns_stuff_CFLAGS = -DWITHOUT_NPTH=1  $(USE_C99_CFLAGS) \
 		     $(LIBGCRYPT_CFLAGS) \
 	             $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS)
 t_dns_stuff_SOURCES = $(t_common_src) t-dns-stuff.c dns-stuff.c
 t_dns_stuff_LDADD   = $(t_common_ldadd) $(DNSLIBS)
 
 $(PROGRAMS) : $(libcommon) $(libcommonpth)
diff --git a/kbx/Makefile.am b/kbx/Makefile.am
index dd727e1e0..f5fe341bc 100644
--- a/kbx/Makefile.am
+++ b/kbx/Makefile.am
@@ -1,107 +1,107 @@
 # Keybox Makefile
 # Copyright (C) 2001, 2002, 2003 Free Software Foundation, Inc.
 #
 # This file is part of GnuPG.
 #
 # GnuPG is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # GnuPG is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, see <https://www.gnu.org/licenses/>.
 
 ## Process this file with automake to produce Makefile.in
 
 EXTRA_DIST = mkerrors keyboxd-w32info.rc
 
 AM_CPPFLAGS =
 
 include $(top_srcdir)/am/cmacros.am
 if HAVE_W32_SYSTEM
 resource_objs += keyboxd-w32info.o
 endif
 
 AM_CFLAGS = $(LIBGCRYPT_CFLAGS) $(KSBA_CFLAGS)
 
 bin_PROGRAMS = kbxutil
 noinst_LIBRARIES = libkeybox.a libkeybox509.a
 if BUILD_KEYBOXD
 libexec_PROGRAMS = keyboxd
 else
 libexec_PROGRAMS =
 endif
 
 if HAVE_W32CE_SYSTEM
 extra_libs =  $(LIBASSUAN_LIBS)
 else
 extra_libs =
 endif
 
 common_libs = $(libcommon)
 commonpth_libs = $(libcommonpth)
 
 common_sources = \
 	keybox.h keybox-defs.h keybox-search-desc.h \
 	keybox-util.c \
 	keybox-init.c \
 	keybox-blob.c \
 	keybox-file.c \
 	keybox-search.c \
 	keybox-update.c \
 	keybox-openpgp.c \
 	keybox-dump.c
 
 client_sources = \
         kbx-client-util.h \
         kbx-client-util.c
 
 
 libkeybox_a_SOURCES = $(common_sources) $(client_sources)
 libkeybox509_a_SOURCES = $(common_sources) $(client_sources)
 
-libkeybox_a_CFLAGS = $(AM_CFLAGS) $(LIBASSUAN_CFLAGS)
-libkeybox509_a_CFLAGS = $(AM_CFLAGS) $(LIBASSUAN_CFLAGS) -DKEYBOX_WITH_X509=1
+libkeybox_a_CFLAGS = $(AM_CFLAGS) $(LIBASSUAN_CFLAGS) $(NPTH_CFLAGS)
+libkeybox509_a_CFLAGS = $(AM_CFLAGS) $(LIBASSUAN_CFLAGS) $(NPTH_CFLAGS) -DKEYBOX_WITH_X509=1
 
 
 # We need W32SOCKLIBS because the init subsystem code in libcommon
 # requires it - although we don't actually need it.  It is easier
 # to do it this way.
 kbxutil_SOURCES = kbxutil.c $(common_sources)
 kbxutil_CFLAGS = $(AM_CFLAGS) -DKEYBOX_WITH_X509=1
 kbxutil_LDADD   = $(common_libs) \
                   $(KSBA_LIBS) $(LIBGCRYPT_LIBS) $(extra_libs) \
                   $(GPG_ERROR_LIBS) $(LIBINTL) $(LIBICONV) $(W32SOCKLIBS) \
 		  $(NETLIBS)
 
 
 keyboxd_SOURCES = \
 	keyboxd.c keyboxd.h   \
 	kbxserver.c           \
 	frontend.c frontend.h \
 	backend.h backend-support.c \
 	backend-cache.c \
 	backend-kbx.c \
 	backend-sqlite.c \
 	$(common_sources)
 
 keyboxd_CFLAGS = $(AM_CFLAGS) -DKEYBOX_WITH_X509=1 \
                  $(LIBASSUAN_CFLAGS) $(NPTH_CFLAGS) $(SQLITE3_CFLAGS) \
                  $(INCICONV)
 keyboxd_LDADD = $(commonpth_libs) \
                 $(KSBA_LIBS) $(LIBGCRYPT_LIBS) $(LIBASSUAN_LIBS) $(NPTH_LIBS) \
 	        $(SQLITE3_LIBS) $(GPG_ERROR_LIBS) \
                 $(LIBINTL) $(NETLIBS) $(LIBICONV) \
 		$(resource_objs)
 keyboxd_LDFLAGS = $(extra_bin_ldflags)
 keyboxd_DEPENDENCIES = $(resource_objs)
 
 
 # Make sure that all libs are build before we use them.  This is
 # important for things like make -j2.
 $(PROGRAMS): $(common_libs) $(commonpth_libs)
diff --git a/tools/Makefile.am b/tools/Makefile.am
index 4c29f84ed..9e9e13eda 100644
--- a/tools/Makefile.am
+++ b/tools/Makefile.am
@@ -1,227 +1,228 @@
 # Makefile.am - Tools directory
 #     	Copyright (C) 2003, 2007 Free Software Foundation, Inc.
 #
 # This file is part of GnuPG.
 #
 # GnuPG is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # GnuPG is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, see <https://www.gnu.org/licenses/>.
 
 EXTRA_DIST = \
 	Manifest watchgnupg.c no-libgcrypt.c \
 	addgnupghome applygnupgdefaults \
 	lspgpot mail-signed-keys convert-from-106 sockprox.c \
 	ccidmon.c ChangeLog-2011 \
 	gpg-connect-agent-w32info.rc gpg-connect-agent.w32-manifest.in \
 	gpgconf-w32info.rc           gpgconf.w32-manifest.in \
 	gpgtar-w32info.rc            gpgtar.w32-manifest.in \
 	gpg-check-pattern-w32info.rc gpg-check-pattern.w32-manifest.in \
 	gpg-wks-client-w32info.rc    gpg-wks-client.w32-manifest.in \
 	gpg-card-w32info.rc          gpg-card.w32-manifest.in
 
 AM_CPPFLAGS =
 include $(top_srcdir)/am/cmacros.am
 
 if HAVE_W32_SYSTEM
 gpg_connect_agent_rc_objs = gpg-connect-agent-w32info.o
 gpgconf_rc_objs           = gpgconf-w32info.o
 gpg_card_rc_objs          = gpg-card-w32info.o
 gpgtar_rc_objs            = gpgtar-w32info.o
 gpg_check_pattern_rc_objs = gpg-check-pattern-w32info.o
 gpg_wks_client_rc_objs    = gpg-wks-client-w32info.o
 resource_objs += $(gpg_connect_agent_rc_objs)
 resource_objs += $(gpgconf_rc_objs)
 resource_objs += $(gpg_card_tool_rc_objs)
 resource_objs += $(gpgtar_rc_objs)
 resource_objs += $(gpg_check_pattern_rc_objs)
 resource_objs += $(gpg_wks_client_rc_objs)
 endif
 
 AM_CFLAGS = $(LIBGCRYPT_CFLAGS) $(GPG_ERROR_CFLAGS) $(LIBASSUAN_CFLAGS)
 
 sbin_SCRIPTS = addgnupghome applygnupgdefaults
 
 if BUILD_WKS_TOOLS
   gpg_wks_server = gpg-wks-server
 else
   gpg_wks_server =
 endif
 
 
 bin_PROGRAMS = gpgconf gpg-connect-agent gpg-card gpg-wks-client
 if !HAVE_W32_SYSTEM
 bin_PROGRAMS += watchgnupg gpgparsemail ${gpg_wks_server} gpgsplit
 else
 bin_PROGRAMS += gpgconf-w32
 endif
 
 libexec_PROGRAMS = gpg-check-pattern gpg-pair-tool
 
 if !HAVE_W32CE_SYSTEM
 noinst_PROGRAMS = clean-sat make-dns-cert
 endif
 
 if !HAVE_W32CE_SYSTEM
 if BUILD_GPGTAR
   bin_PROGRAMS += gpgtar
 else
   noinst_PROGRAMS += gpgtar
 endif
 endif
 
 common_libs = $(libcommon)
 commonpth_libs = $(libcommonpth)
 
 # Some modules require PTH under W32CE.
 if HAVE_W32CE_SYSTEM
 maybe_commonpth_libs = $(commonpth_libs)
 else
 maybe_commonpth_libs = $(common_libs)
 endif
 
 if HAVE_W32CE_SYSTEM
 pwquery_libs =
 else
 pwquery_libs = ../common/libsimple-pwquery.a
 endif
 
 if HAVE_W32CE_SYSTEM
 opt_libassuan_libs = $(LIBASSUAN_LIBS)
 endif
 
 regexp_libs = ../regexp/libregexp.a
 
 
 gpgsplit_LDADD = $(common_libs) \
 	         $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) \
 		 $(ZLIBS) $(LIBINTL) $(NETLIBS) $(LIBICONV)
 
 gpgconf_SOURCES = gpgconf.c gpgconf.h gpgconf-comp.c
 
 # common sucks in gpg-error, will they, nil they (some compilers
 # do not eliminate the supposed-to-be-unused-inline-functions).
 gpgconf_LDADD = $(maybe_commonpth_libs) $(opt_libassuan_libs) \
                 $(LIBINTL) $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) $(NETLIBS) \
 	        $(LIBICONV) $(W32SOCKLIBS) \
 	        $(gpgconf_rc_objs)
 gpgconf_LDFLAGS = $(extra_bin_ldflags)
 
 gpgconf_w32_SOURCES = $(gpgconf_SOURCES)
 gpgconf_w32_LDADD = $(gpgconf_LDADD)
 gpgconf_w32_LDFLAGS = $(gpgconf_LDFLAGS) -Wl,-subsystem,windows
 
 gpgparsemail_SOURCES = gpgparsemail.c rfc822parse.c rfc822parse.h
 gpgparsemail_LDADD =
 
 watchgnupg_SOURCES = watchgnupg.c
 watchgnupg_LDADD = $(NETLIBS)
 
 gpg_connect_agent_SOURCES = gpg-connect-agent.c
 gpg_connect_agent_LDADD = ../common/libgpgrl.a $(common_libs) \
 	                  $(LIBASSUAN_LIBS) $(LIBGCRYPT_LIBS) \
                           $(GPG_ERROR_LIBS) \
                           $(LIBREADLINE) $(LIBINTL) $(NETLIBS) $(LIBICONV) \
                           $(gpg_connect_agent_rc_objs)
 
 
 gpg_card_SOURCES   = \
 	gpg-card.c \
 	gpg-card.h     \
 	card-call-scd.c \
 	card-keys.c \
 	card-yubikey.c \
 	card-misc.c
 
 gpg_card_LDADD = \
 	../common/libgpgrl.a $(common_libs) \
 	$(LIBASSUAN_LIBS) $(LIBGCRYPT_LIBS) \
 	$(GPG_ERROR_LIBS) \
         $(LIBREADLINE) $(LIBINTL) $(NETLIBS) $(LIBICONV) \
         $(gpg_card_rc_objs)
 
 
 gpg_check_pattern_SOURCES = gpg-check-pattern.c
 gpg_check_pattern_CFLAGS = $(LIBGCRYPT_CFLAGS) $(GPG_ERROR_CFLAGS) $(INCICONV)
 gpg_check_pattern_LDADD = $(common_libs) $(regexp_libs) $(LIBGCRYPT_LIBS) \
 			  $(GPG_ERROR_LIBS) \
 			  $(LIBINTL) $(NETLIBS) $(LIBICONV) $(W32SOCKLIBS) \
 			  $(LIBICONV) \
 		          $(gpg_check_pattern_rc_objs)
 
 gpgtar_SOURCES = \
 	gpgtar.c gpgtar.h \
 	gpgtar-create.c \
 	gpgtar-extract.c \
 	gpgtar-list.c
-gpgtar_CFLAGS = $(GPG_ERROR_CFLAGS)
+gpgtar_CFLAGS = $(LIBGCRYPT_CFLAGS) $(GPG_ERROR_CFLAGS)
 gpgtar_LDADD = $(libcommon) $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) \
                $(LIBINTL) $(NETLIBS) $(LIBICONV) $(W32SOCKLIBS) \
 	       $(gpgtar_rc_objs)
 
 gpg_wks_server_SOURCES = \
 	gpg-wks-server.c \
 	gpg-wks.h \
 	wks-util.c \
 	wks-receive.c \
 	rfc822parse.c rfc822parse.h \
 	mime-parser.c mime-parser.h \
 	mime-maker.c  mime-maker.h  \
 	send-mail.c   send-mail.h
 
-gpg_wks_server_CFLAGS = $(GPG_ERROR_CFLAGS) $(INCICONV)
+gpg_wks_server_CFLAGS = $(LIBGCRYPT_CFLAGS) $(GPG_ERROR_CFLAGS) $(INCICONV)
 gpg_wks_server_LDADD = $(libcommon) $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) \
 		       $(LIBINTL) $(LIBICONV)
 
 gpg_wks_client_SOURCES = \
 	gpg-wks-client.c \
 	gpg-wks.h  \
 	wks-util.c \
 	wks-receive.c \
 	rfc822parse.c rfc822parse.h \
 	mime-parser.c mime-parser.h \
 	mime-maker.h  mime-maker.c  \
 	send-mail.c   send-mail.h   \
 	call-dirmngr.c call-dirmngr.h
 
-gpg_wks_client_CFLAGS = $(LIBASSUAN_CFLAGS) $(GPG_ERROR_CFLAGS) $(INCICONV)
+gpg_wks_client_CFLAGS = $(LIBASSUAN_CFLAGS) $(LIBGCRYPT_CFLAGS) \
+			$(GPG_ERROR_CFLAGS) $(INCICONV)
 gpg_wks_client_LDADD = $(libcommon) \
 		       $(LIBASSUAN_LIBS) $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) \
 		       $(LIBINTL) $(LIBICONV) $(NETLIBS) \
 	               $(gpg_wks_client_rc_objs)
 
 gpg_pair_tool_SOURCES = \
 	gpg-pair-tool.c
 
-gpg_pair_tool_CFLAGS = $(GPG_ERROR_CFLAGS) $(INCICONV)
+gpg_pair_tool_CFLAGS = $(LIBGCRYPT_CFLAGS) $(GPG_ERROR_CFLAGS) $(INCICONV)
 gpg_pair_tool_LDADD =  $(libcommon) \
 		       $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) \
 		       $(LIBINTL) $(LIBICONV) $(W32SOCKLIBS)
 
 # Instead of a symlink we install a simple wrapper script for the new
 # gpg-wks-client location.  We assume bin is a sibling of libexec.
 install-exec-local:
 	$(mkinstalldirs) $(DESTDIR)$(libexecdir)
 	(set -e ;\
 	 if [ "$(libexecdir)" != "$(bindir)" ]; then \
 	   printf '#!/bin/sh\nexec "$(bindir)/gpg-wks-client" "$$@"\n' \
 	          > $(DESTDIR)$(libexecdir)/gpg-wks-client ;\
 	   chmod +x $(DESTDIR)$(libexecdir)/gpg-wks-client ;\
 	 fi )
 
 uninstall-local:
 	(if [ "$(libexecdir)" != "$(bindir)" ]; then \
 	   rm $(DESTDIR)$(libexecdir)/gpg-wks-client || true ;\
          fi )
 
 # Make sure that all libs are build before we use them.  This is
 # important for things like make -j2.
 $(PROGRAMS): $(common_libs) $(pwquery_libs) ../common/libgpgrl.a