diff -Naurp bind-9.18.16.orig/bin/dnssec/Makefile.am bind-9.18.16/bin/dnssec/Makefile.am
--- bind-9.18.16.orig/bin/dnssec/Makefile.am	2023-06-09 09:48:46.008533785 -0400
+++ bind-9.18.16/bin/dnssec/Makefile.am	2023-06-29 19:38:48.245679147 -0400
@@ -14,8 +14,13 @@ LDADD +=			\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)
 
-bin_PROGRAMS = \
-	dnssec-cds		\
+if !BIND_TOOLS_ONLY
+bin_PROGRAMS = dnssec-cds
+else
+bin_PROGRAMS =
+endif
+
+bin_PROGRAMS += \
 	dnssec-dsfromkey	\
 	dnssec-importkey	\
 	dnssec-keyfromlabel	\
diff -Naurp bind-9.18.16.orig/bin/Makefile.am bind-9.18.16/bin/Makefile.am
--- bind-9.18.16.orig/bin/Makefile.am	2023-06-09 09:48:46.004533711 -0400
+++ bind-9.18.16/bin/Makefile.am	2023-06-29 19:38:48.245679147 -0400
@@ -1 +1,5 @@
+if BIND_TOOLS_ONLY
+SUBDIRS = delv dig dnssec nsupdate
+else
 SUBDIRS = named rndc dig delv dnssec tools nsupdate check confgen tests plugins
+endif
diff -Naurp bind-9.18.16.orig/configure.ac bind-9.18.16/configure.ac
--- bind-9.18.16.orig/configure.ac	2023-06-09 09:48:46.132536081 -0400
+++ bind-9.18.16/configure.ac	2023-06-29 19:39:02.486083386 -0400
@@ -1199,6 +1199,17 @@ AS_IF([test "$enable_dnstap" != "no"],
 AC_SUBST([DNSTAP_CFLAGS])
 AC_SUBST([DNSTAP_LIBS])
 AM_CONDITIONAL([HAVE_DNSTAP], [test "$enable_dnstap" != "no"])
+
+#
+# Build only the tools or build everything?
+#
+# [pairwise: --enable-tools-only, --disable-tools-only]
+AC_ARG_ENABLE([tools-only],
+	      [AS_HELP_STRING([--enable-tools-only],
+			      [enable building only the common tools? [default=no]])],
+	      [], [enable_tools_only="no"])
+AM_CONDITIONAL([BIND_TOOLS_ONLY], [test "$enable_tools_only" = "yes"])
+
 #
 # The following sections deal with tools used for formatting
 # the documentation.  They are all optional, unless you are
@@ -1589,6 +1600,12 @@ report() {
     if test "yes" = "$with_jemalloc"; then
 	echo "    Memory allocator: jemalloc"
     fi
+    if test "yes" = "$enable_tools_only"; then
+	echo "    Only building the following BIND9 tools:"
+	echo "        delv, dig, dnssec-dsfromkey, dnssec-importkey,"
+	echo "        dnssec-keyfromlabel, dnssec-revoke, dnssec-keygen, dnssec-settime,"
+	echo "        dnssec-signzone, dnssec-verify, host, nslookup, nsupdate"
+    fi
     if test "yes" = "$enable_full_report" -o "standard" = "$with_locktype"; then
 	echo "    Mutex lock type: $with_locktype"
     fi
diff -Naurp bind-9.18.16.orig/lib/Makefile.am bind-9.18.16/lib/Makefile.am
--- bind-9.18.16.orig/lib/Makefile.am	2023-06-09 09:48:46.168536747 -0400
+++ bind-9.18.16/lib/Makefile.am	2023-06-29 19:38:48.245679147 -0400
@@ -1,3 +1,7 @@
 include $(top_srcdir)/Makefile.top
 
+if BIND_TOOLS_ONLY
+SUBDIRS = isc dns ns isccfg bind9 irs
+else
 SUBDIRS = isc dns isccc ns isccfg bind9 irs
+endif