diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index 4bcb4882d733c4..7ac4ea557f9f10 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -39,7 +39,11 @@ endif
 define Package/base-files
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=+netifd +libc +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring +NAND_SUPPORT:ubi-utils +fstools +fwtool
+  DEPENDS:= \
+	+netifd +libc +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring \
+	+NAND_SUPPORT:ubi-utils +fstools +fwtool \
+	+SELINUX:procd-selinux +!SELINUX:procd +SECCOMP:procd-seccomp \
+	+SELINUX:busybox-selinux +!SELINUX:busybox
   TITLE:=Base filesystem for OpenWrt
   URL:=http://openwrt.org/
   VERSION:=$(PKG_RELEASE)~$(lastword $(subst -, ,$(REVISION)))
diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile
index 9ff6fb80f7c949..86de4babfdfaff 100644
--- a/package/system/procd/Makefile
+++ b/package/system/procd/Makefile
@@ -50,7 +50,6 @@ define Package/procd
   $(call Package/procd/Default)
   VARIANT:=default
   CONFLICTS:=procd-selinux
-  DEFAULT:=y if !SELINUX
 endef
 
 define Package/procd-selinux
@@ -59,7 +58,6 @@ define Package/procd-selinux
   TITLE += with SELinux support
   PROVIDES:=procd
   VARIANT:=selinux
-  DEFAULT:=y if SELINUX
 endef
 
 define Package/procd-ujail
@@ -75,7 +73,6 @@ define Package/procd-seccomp
   CATEGORY:=Base system
   DEPENDS:=@SECCOMP +libubox +libblobmsg-json
   TITLE:=OpenWrt process seccomp helper + utrace
-  DEFAULT:=y if SECCOMP
 endef
 
 define Package/uxc
diff --git a/package/utils/busybox/Makefile b/package/utils/busybox/Makefile
index 7b591db71679c7..4ef470df755890 100644
--- a/package/utils/busybox/Makefile
+++ b/package/utils/busybox/Makefile
@@ -56,7 +56,6 @@ define Package/busybox
   $(call Package/busybox/Default)
   CONFLICTS:=busybox-selinux
   VARIANT:=default
-  DEFAULT:=y if !SELINUX
 endef
 
 define Package/busybox-selinux
@@ -65,7 +64,6 @@ define Package/busybox-selinux
   DEPENDS += +libselinux
   VARIANT:=selinux
   PROVIDES:=busybox
-  DEFAULT:=y if SELINUX
 endef
 
 define Package/busybox/description
diff --git a/target/imagebuilder/files/Makefile b/target/imagebuilder/files/Makefile
index 72b36b0862389d..c92ab7430663b7 100644
--- a/target/imagebuilder/files/Makefile
+++ b/target/imagebuilder/files/Makefile
@@ -138,6 +138,11 @@ _call_info: FORCE
 	echo 'Available Profiles:'
 	echo; $(PROFILE_LIST)
 
+ifneq ($(CONFIG_USE_APK),)
+  DEFAULT_PACKAGES += apk-mbedtls
+else
+  DEFAULT_PACKAGES += opkg
+endif
 BUILD_PACKAGES:=$(sort $(DEFAULT_PACKAGES) $($(USER_PROFILE)_PACKAGES) kernel)
 # "-pkgname" in the package list means remove "pkgname" from the package list
 BUILD_PACKAGES:=$(filter-out $(filter -%,$(BUILD_PACKAGES)) $(patsubst -%,%,$(filter -%,$(BUILD_PACKAGES))),$(BUILD_PACKAGES))