diff --git a/Makefile.inc1 b/Makefile.inc1
index 7a9917fd8a7..f97e53cc7f9 100644
--- a/Makefile.inc1
+++ b/Makefile.inc1
@@ -3125,10 +3125,12 @@ _startup_libs=	lib/csu
 _startup_libs+=	lib/libc
 _startup_libs+=	lib/libc_nonshared
 _startup_libs+=	lib/libcxxrt
+_startup_libs+=	lib/libsys
 
 _prereq_libs+=	lib/libgcc_eh lib/libgcc_s
 _startup_libs+=	lib/libgcc_eh lib/libgcc_s
 
+lib/libc__L: lib/libsys__L
 lib/libgcc_s__L: lib/libc__L
 lib/libgcc_s__L: lib/libc_nonshared__L
 lib/libcxxrt__L: lib/libgcc_s__L
diff --git a/UPDATING b/UPDATING
index 33bae2a42b9..aae30936a8b 100644
--- a/UPDATING
+++ b/UPDATING
@@ -27,6 +27,12 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 15.x IS SLOW:
 	world, or to merely disable the most expensive debugging functionality
 	at runtime, run "ln -s 'abort:false,junk:false' /etc/malloc.conf".)
 
+20240205:
+	For dynamically linked programs, system calls are now made from
+	libsys rather than libc.  No change in linkage is required as
+	libsys is an auxiliary filter for libc.  People building custom
+	images must ensure that libsys.so.7 is included.
+
 20240202:
 	Loader now also read configuration files listed in local_loader_conf_files.
 	Files listed here are the last ones read. And /boot/loader.conf.local was
diff --git a/lib/Makefile b/lib/Makefile
index db07883e2b1..9d2531820c8 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -123,7 +123,7 @@ SUBDIR_DEPEND_libbsnmp= ${_libnetgraph}
 SUBDIR_DEPEND_libc++:= libcxxrt
 # libssp_nonshared doesn't need to be linked into libc on every arch, but it is
 # small enough to build that this bit of serialization is likely insignificant.
-SUBDIR_DEPEND_libc= libcompiler_rt libssp_nonshared
+SUBDIR_DEPEND_libc= libsys libcompiler_rt libssp_nonshared
 SUBDIR_DEPEND_libcam= libsbuf
 SUBDIR_DEPEND_libcasper= libnv
 SUBDIR_DEPEND_libdevstat= libkvm
diff --git a/lib/libc/Makefile b/lib/libc/Makefile
index 72300e88d3d..6a54f764108 100644
--- a/lib/libc/Makefile
+++ b/lib/libc/Makefile
@@ -62,6 +62,9 @@ CFLAGS+= -ftls-model=initial-exec
 #
 LDFLAGS+= -nodefaultlibs
 LIBADD+=	compiler_rt
+LIBADD+=	sys
+
+LDFLAGS+=-Wl,--auxiliary,libsys.so
 
 .if ${MK_SSP} != "no" && \
     (${LIBC_ARCH} == "i386" || ${LIBC_ARCH:Mpowerpc*} != "")
diff --git a/share/mk/src.libnames.mk b/share/mk/src.libnames.mk
index 5a6932614b2..3c19a4c45da 100644
--- a/share/mk/src.libnames.mk
+++ b/share/mk/src.libnames.mk
@@ -393,7 +393,7 @@ _DP_xo=		util
 _DP_ztest=	geom m nvpair umem zpool pthread avl zfs_core spl zutil zfs uutil icp
 # The libc dependencies are not strictly needed but are defined to make the
 # assert happy.
-_DP_c=		compiler_rt
+_DP_c=		sys compiler_rt
 # Use libssp_nonshared only on i386 and power*.  Other archs emit direct calls
 # to __stack_chk_fail, not __stack_chk_fail_local provided by libssp_nonshared.
 .if ${MK_SSP} != "no" && \