diff --git a/nimble/host/src/ble_sm.c b/nimble/host/src/ble_sm.c
index 2c37e313f..67e8728de 100644
--- a/nimble/host/src/ble_sm.c
+++ b/nimble/host/src/ble_sm.c
@@ -49,7 +49,7 @@
 #include "host/ble_sm.h"
 #include "ble_hs_priv.h"
 
-#if MYNEWT_VAL(BLE_SM)
+#if NIMBLE_BLE_SM
 
 /** Procedure timeout; 30 seconds. */
 #define BLE_SM_TIMEOUT_OS_TICKS             (30 * OS_TICKS_PER_SEC)
diff --git a/nimble/host/src/ble_sm_alg.c b/nimble/host/src/ble_sm_alg.c
index 6b30bd861..759d60b7b 100644
--- a/nimble/host/src/ble_sm_alg.c
+++ b/nimble/host/src/ble_sm_alg.c
@@ -21,8 +21,9 @@
 #include <inttypes.h>
 #include <string.h>
 #include "syscfg/syscfg.h"
+#include "nimble/nimble_opt.h"
 
-#if MYNEWT_VAL(BLE_SM)
+#if NIMBLE_BLE_SM
 
 #include "nimble/ble.h"
 #include "nimble/nimble_opt.h"
diff --git a/nimble/host/src/ble_sm_lgcy.c b/nimble/host/src/ble_sm_lgcy.c
index f26ec4ef6..ddc666de9 100644
--- a/nimble/host/src/ble_sm_lgcy.c
+++ b/nimble/host/src/ble_sm_lgcy.c
@@ -25,7 +25,7 @@
 #include "host/ble_sm.h"
 #include "ble_hs_priv.h"
 
-#if NIMBLE_BLE_SM
+#if MYNEWT_VAL(BLE_SM_LEGACY)
 
 /**
  * Create some shortened names for the passkey actions so that the table is
diff --git a/nimble/host/src/ble_sm_priv.h b/nimble/host/src/ble_sm_priv.h
index ba8a0be08..7d96164b0 100644
--- a/nimble/host/src/ble_sm_priv.h
+++ b/nimble/host/src/ble_sm_priv.h
@@ -403,6 +403,7 @@ void ble_sm_enc_change_rx(struct hci_encrypt_change *evt);
 void ble_sm_enc_key_refresh_rx(struct hci_encrypt_key_refresh *evt);
 int ble_sm_ltk_req_rx(struct hci_le_lt_key_req *evt);
 
+#if MYNEWT_VAL(BLE_SM_LEGACY)
 int ble_sm_lgcy_io_action(struct ble_sm_proc *proc);
 void ble_sm_lgcy_confirm_exec(struct ble_sm_proc *proc,
                               struct ble_sm_result *res);
@@ -410,6 +411,12 @@ void ble_sm_lgcy_random_exec(struct ble_sm_proc *proc,
                              struct ble_sm_result *res);
 void ble_sm_lgcy_random_rx(struct ble_sm_proc *proc,
                            struct ble_sm_result *res);
+#else
+#define ble_sm_lgcy_io_action(proc) (BLE_HS_ENOTSUP)
+#define ble_sm_lgcy_confirm_exec(proc, res)
+#define ble_sm_lgcy_random_exec(proc, res)
+#define ble_sm_lgcy_random_rx(proc, res)
+#endif
 
 #if MYNEWT_VAL(BLE_SM_SC)
 int ble_sm_sc_io_action(struct ble_sm_proc *proc);
diff --git a/nimble/host/syscfg.yml b/nimble/host/syscfg.yml
index 6b4565c45..622291794 100644
--- a/nimble/host/syscfg.yml
+++ b/nimble/host/syscfg.yml
@@ -50,7 +50,7 @@ syscfg.defs:
         value: 30000
 
     # Security manager settings.
-    BLE_SM:
+    BLE_SM_LEGACY:
         description: 'Security manager legacy pairing.'
         value: 1
     BLE_SM_SC:
diff --git a/nimble/include/nimble/nimble_opt_auto.h b/nimble/include/nimble/nimble_opt_auto.h
index 1add6a876..5375e8d5c 100644
--- a/nimble/include/nimble/nimble_opt_auto.h
+++ b/nimble/include/nimble/nimble_opt_auto.h
@@ -21,7 +21,6 @@
 #define H_NIMBLE_OPT_AUTO_
 
 #include "syscfg/syscfg.h"
-#include "nimble/nimble_opt.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -30,8 +29,8 @@ extern "C" {
 /***
  * Automatic options.
  * 
- * These settings are generated automatically from the user-specified settings
- * in nimble_opt.h.
+ * These settings are generated automatically from the user-specified syscfg
+ * settings.
  */
 
 #undef NIMBLE_BLE_ADVERTISE
@@ -108,14 +107,8 @@ extern "C" {
 
 /** Security manager settings. */
 
-
-/* Secure connections implies security manager support
- * Note: For now, security manager is synonymous with legacy pairing.  In the
- * future, a new setting for legacy pairing may be introduced as a sibling of
- * the SC setting.
- */
 #undef NIMBLE_BLE_SM
-#define NIMBLE_BLE_SM   (MYNEWT_VAL(BLE_SM) || MYNEWT_VAL(BLE_SM_SC))
+#define NIMBLE_BLE_SM   (MYNEWT_VAL(BLE_SM_LEGACY) || MYNEWT_VAL(BLE_SM_SC))
 
 #ifdef __cplusplus
 }