diff --git a/src/lib/libutil/Makefile b/src/lib/libutil/Makefile
index 11bcfcdd..ad279fac 100644
--- a/src/lib/libutil/Makefile
+++ b/src/lib/libutil/Makefile
@@ -1,8 +1,10 @@
-#	$OpenBSD: Makefile,v 1.39 2016/03/30 06:38:43 jmc Exp $
+#	$OpenBSD: Makefile,v 1.40 2017/12/14 09:27:44 kettenis Exp $
 #	$NetBSD: Makefile,v 1.8 1996/05/16 07:03:28 thorpej Exp $
 
 LIB=	util
 
+VERSION_SCRIPT=	${.CURDIR}/Symbols.map
+
 HDRS=	util.h imsg.h
 SRCS=	bcrypt_pbkdf.c check_expire.c duid.c getmaxpartitions.c \
 	getrawpartition.c login.c \
diff --git a/src/lib/libutil/Symbols.map b/src/lib/libutil/Symbols.map
new file mode 100644
index 00000000..942ea279
--- /dev/null
+++ b/src/lib/libutil/Symbols.map
@@ -0,0 +1,92 @@
+/*
+ * In order to guarantee that static and shared archs see the same "public"
+ * symbols, this file should always include all the non-static symbols that
+ * are in the application namespace.  So, if a symbol starts with a letter,
+ * don't delete it from here without either making it static or renaming it
+ * to have a leading underbar.
+ */
+
+{
+	global:
+		bcrypt_pbkdf;
+		fdforkpty;
+		fdopenpty;
+		fmt_scaled;
+		forkpty;
+		fparseln;
+		getmaxpartitions;
+		getptmfd;
+		getrawpartition;
+		ibuf_add;
+		ibuf_close;
+		ibuf_dynamic;
+		ibuf_free;
+		ibuf_left;
+		ibuf_open;
+		ibuf_reserve;
+		ibuf_seek;
+		ibuf_size;
+		ibuf_write;
+		imsg_add;
+		imsg_clear;
+		imsg_close;
+		imsg_compose;
+		imsg_composev;
+		imsg_create;
+		imsg_fd_overhead;
+		imsg_flush;
+		imsg_free;
+		imsg_get;
+		imsg_init;
+		imsg_read;
+		isduid;
+		login;
+		login_check_expire;
+		login_fbtab;
+		login_tty;
+		logout;
+		logwtmp;
+		msgbuf_clear;
+		msgbuf_drain;
+		msgbuf_init;
+		msgbuf_write;
+		ohash_create_entry;
+		ohash_delete;
+		ohash_entries;
+		ohash_find;
+		ohash_first;
+		ohash_init;
+		ohash_insert;
+		ohash_interval;
+		ohash_lookup_interval;
+		ohash_lookup_memory;
+		ohash_next;
+		ohash_qlookup;
+		ohash_qlookupi;
+		ohash_remove;
+		opendev;
+		opendisk;
+		openpty;
+		pidfile;
+		pkcs5_pbkdf2;
+		pw_abort;
+		pw_copy;
+		pw_edit;
+		pw_error;
+		pw_file;
+		pw_init;
+		pw_lock;
+		pw_mkdb;
+		pw_prompt;
+		pw_scan;
+		pw_setdir;
+		readlabelfs;
+		scan_scaled;
+		uu_lock;
+		uu_lock_txfr;
+		uu_lockerr;
+		uu_unlock;
+
+	local:
+		*;
+};
diff --git a/src/lib/libutil/imsg-buffer.c b/src/lib/libutil/imsg-buffer.c
index 821cb956..a4aee60b 100644
--- a/src/lib/libutil/imsg-buffer.c
+++ b/src/lib/libutil/imsg-buffer.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: imsg-buffer.c,v 1.10 2017/04/11 09:57:19 reyk Exp $	*/
+/*	$OpenBSD: imsg-buffer.c,v 1.11 2017/12/14 09:27:44 kettenis Exp $	*/
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -29,9 +29,9 @@
 
 #include "imsg.h"
 
-int	ibuf_realloc(struct ibuf *, size_t);
-void	ibuf_enqueue(struct msgbuf *, struct ibuf *);
-void	ibuf_dequeue(struct msgbuf *, struct ibuf *);
+static int	ibuf_realloc(struct ibuf *, size_t);
+static void	ibuf_enqueue(struct msgbuf *, struct ibuf *);
+static void	ibuf_dequeue(struct msgbuf *, struct ibuf *);
 
 struct ibuf *
 ibuf_open(size_t len)
@@ -67,7 +67,7 @@ ibuf_dynamic(size_t len, size_t max)
 	return (buf);
 }
 
-int
+static int
 ibuf_realloc(struct ibuf *buf, size_t len)
 {
 	u_char	*b;
@@ -289,14 +289,14 @@ again:
 	return (1);
 }
 
-void
+static void
 ibuf_enqueue(struct msgbuf *msgbuf, struct ibuf *buf)
 {
 	TAILQ_INSERT_TAIL(&msgbuf->bufs, buf, entry);
 	msgbuf->queued++;
 }
 
-void
+static void
 ibuf_dequeue(struct msgbuf *msgbuf, struct ibuf *buf)
 {
 	TAILQ_REMOVE(&msgbuf->bufs, buf, entry);
diff --git a/src/lib/libutil/imsg.c b/src/lib/libutil/imsg.c
index 89d16ae8..c0ff2297 100644
--- a/src/lib/libutil/imsg.c
+++ b/src/lib/libutil/imsg.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: imsg.c,v 1.15 2017/04/11 09:57:19 reyk Exp $	*/
+/*	$OpenBSD: imsg.c,v 1.16 2017/12/14 09:27:44 kettenis Exp $	*/
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -30,7 +30,7 @@
 
 int	 imsg_fd_overhead = 0;
 
-int	 imsg_get_fd(struct imsgbuf *);
+static int	 imsg_get_fd(struct imsgbuf *);
 
 void
 imsg_init(struct imsgbuf *ibuf, int fd)
@@ -266,7 +266,7 @@ imsg_free(struct imsg *imsg)
 	freezero(imsg->data, imsg->hdr.len - IMSG_HEADER_SIZE);
 }
 
-int
+static int
 imsg_get_fd(struct imsgbuf *ibuf)
 {
 	int		 fd;
diff --git a/src/lib/libutil/shlib_version b/src/lib/libutil/shlib_version
index 7b5f7ac5..262f3bc1 100644
--- a/src/lib/libutil/shlib_version
+++ b/src/lib/libutil/shlib_version
@@ -1,2 +1,2 @@
-major=12
-minor=2
+major=13
+minor=0