diff --git a/configs/tools-only_defconfig b/configs/tools-only_defconfig
index 054e008b2a..64eb766515 100644
--- a/configs/tools-only_defconfig
+++ b/configs/tools-only_defconfig
@@ -35,3 +35,4 @@ CONFIG_I2C_EDID=y
 # CONFIG_VIRTIO_SANDBOX is not set
 # CONFIG_GENERATE_ACPI_TABLE is not set
 # CONFIG_EFI_LOADER is not set
+CONFIG_TOOLS_MKEFICAPSULE=y
diff --git a/tools/Kconfig b/tools/Kconfig
index 91ce8ae3e5..117c921da3 100644
--- a/tools/Kconfig
+++ b/tools/Kconfig
@@ -90,4 +90,12 @@ config TOOLS_SHA512
 	help
 	  Enable SHA512 support in the tools builds
 
+config TOOLS_MKEFICAPSULE
+	bool "Build efimkcapsule command"
+	default y if EFI_CAPSULE_ON_DISK
+	help
+	  This command allows users to create a UEFI capsule file and,
+	  optionally sign that file. If you want to enable UEFI capsule
+	  update feature on your target, you certainly need this.
+
 endmenu
diff --git a/tools/Makefile b/tools/Makefile
index 1763f44cac..766c0674f4 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -238,8 +238,7 @@ hostprogs-$(CONFIG_MIPS) += mips-relocs
 hostprogs-$(CONFIG_ASN1_COMPILER)	+= asn1_compiler
 HOSTCFLAGS_asn1_compiler.o = -idirafter $(srctree)/include
 
-mkeficapsule-objs	:= mkeficapsule.o $(LIBFDT_OBJS)
-hostprogs-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += mkeficapsule
+hostprogs-$(CONFIG_TOOLS_MKEFICAPSULE) += mkeficapsule
 
 # We build some files with extra pedantic flags to try to minimize things
 # that won't build on some weird host compiler -- though there are lots of