diff --git a/cmd/Kconfig b/cmd/Kconfig
index b05e69a8b73..1e3cd027031 100644
--- a/cmd/Kconfig
+++ b/cmd/Kconfig
@@ -350,6 +350,7 @@ config CMD_MEMORY
 
 config CMD_CRC32
 	bool "crc32"
+	select HASH
 	default y
 	help
 	  Compute CRC32.
@@ -998,6 +999,7 @@ config CMD_BLOB
 
 config CMD_HASH
 	bool "Support 'hash' command"
+	select HASH
 	help
 	  This provides a way to hash data in memory using various supported
 	  algorithms (such as SHA1, MD5, CRC32). The computed digest can be
diff --git a/common/Kconfig b/common/Kconfig
index 1879aefaf83..5c39663f56a 100644
--- a/common/Kconfig
+++ b/common/Kconfig
@@ -493,4 +493,16 @@ config BOARD_EARLY_INIT_F
 
 endmenu
 
+menu "Security support"
+
+config HASH
+	bool # "Support hashing API (SHA1, SHA256, etc.)"
+	help
+	  This provides a way to hash data in memory using various supported
+	  algorithms (such as SHA1, MD5, CRC32). The API is defined in hash.h
+	  and the algorithms it supports are defined in common/hash.c. See
+	  also CMD_HASH for command-line access.
+
+endmenu
+
 source "common/spl/Kconfig"
diff --git a/common/Makefile b/common/Makefile
index 14d01844adb..b2d663530db 100644
--- a/common/Makefile
+++ b/common/Makefile
@@ -10,7 +10,7 @@ ifndef CONFIG_SPL_BUILD
 obj-y += init/
 obj-y += main.o
 obj-y += exports.o
-obj-y += hash.o
+obj-$(CONFIG_HASH) += hash.o
 obj-$(CONFIG_HUSH_PARSER) += cli_hush.o
 obj-$(CONFIG_AUTOBOOT) += autoboot.o
 
diff --git a/common/hash.c b/common/hash.c
index b645298afcd..a0eded98d06 100644
--- a/common/hash.c
+++ b/common/hash.c
@@ -473,5 +473,5 @@ int hash_command(const char *algo_name, int flags, cmd_tbl_t *cmdtp, int flag,
 
 	return 0;
 }
-#endif
-#endif
+#endif /* CONFIG_CMD_HASH || CONFIG_CMD_SHA1SUM || CONFIG_CMD_CRC32) */
+#endif /* !USE_HOSTCC */