diff --git a/meson.build b/meson.build
index 2e3898b3b1..fdf26f9aab 100644
--- a/meson.build
+++ b/meson.build
@@ -589,7 +589,8 @@ conf.set('GPERF_LEN_TYPE', gperf_len_type,
 if not cc.has_header('sys/capability.h')
         error('POSIX caps headers not found')
 endif
-foreach header : ['linux/btrfs.h',
+foreach header : ['crypt.h',
+                  'linux/btrfs.h',
                   'linux/memfd.h',
                   'linux/vm_sockets.h',
                   'sys/auxv.h',
diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
index 1dbceb8803..262e520d56 100644
--- a/src/firstboot/firstboot.c
+++ b/src/firstboot/firstboot.c
@@ -23,6 +23,19 @@
 #include <shadow.h>
 #include <unistd.h>
 
+#ifdef HAVE_CRYPT_H
+/* libxcrypt is a replacement for glibc's libcrypt, and libcrypt might be
+ * removed from glibc at some point. As part of the removal, defines for
+ * crypt(3) are dropped from unistd.h, and we must include crypt.h instead.
+ *
+ * Newer versions of glibc (v2.0+) already ship crypt.h with a definition
+ * of crypt(3) as well, so we simply include it if it is present.  MariaDB,
+ * MySQL, PostgreSQL, Perl and some other wide-spread packages do it the
+ * same way since ages without any problems.
+ */
+#  include <crypt.h>
+#endif
+
 #include "sd-id128.h"
 
 #include "alloc-util.h"