diff --git a/m4/virt-gnutls.m4 b/m4/virt-gnutls.m4
index 9e8bfb1c06..b85082852f 100644
--- a/m4/virt-gnutls.m4
+++ b/m4/virt-gnutls.m4
@@ -20,41 +20,43 @@ dnl
 AC_DEFUN([LIBVIRT_CHECK_GNUTLS],[
   LIBVIRT_CHECK_PKG([GNUTLS], [gnutls], [2.2.0])
 
-  dnl Double probe: gnutls >= 2.12 had a configure option for gcrypt and
-  dnl gnutls >= 3.0 uses only nettle.  Our goal is to avoid gcrypt if we
-  dnl can prove gnutls uses nettle, but it is a safe fallback to use gcrypt
-  dnl if we can't prove anything.
+  if test "$with_gnutls" = "yes" ; then
+    dnl Double probe: gnutls >= 2.12 had a configure option for gcrypt and
+    dnl gnutls >= 3.0 uses only nettle.  Our goal is to avoid gcrypt if we
+    dnl can prove gnutls uses nettle, but it is a safe fallback to use gcrypt
+    dnl if we can't prove anything.
 
-  GNUTLS_GCRYPT=
-  if $PKG_CONFIG --exists 'gnutls >= 3.0'; then
-    GNUTLS_GCRYPT="no"
-  else
-    GNUTLS_GCRYPT="probe"
+    GNUTLS_GCRYPT=
+    if $PKG_CONFIG --exists 'gnutls >= 3.0'; then
+      GNUTLS_GCRYPT="no"
+    else
+      GNUTLS_GCRYPT="probe"
+    fi
+
+    if test "$GNUTLS_GCRYPT" = "probe"; then
+      case $($PKG_CONFIG --libs --static gnutls) in
+        *gcrypt*) GNUTLS_GCRYPT=yes       ;;
+        *nettle*) GNUTLS_GCRYPT=no        ;;
+        *)        GNUTLS_GCRYPT=unknown   ;;
+      esac
+    fi
+
+    if test "$GNUTLS_GCRYPT" = "yes" || test "$GNUTLS_GCRYPT" = "unknown"; then
+      GNUTLS_LIBS="$GNUTLS_LIBS -lgcrypt"
+      dnl We're not using gcrypt deprecated features so define
+      dnl GCRYPT_NO_DEPRECATED to avoid deprecated warnings
+      GNUTLS_CFLAGS="$GNUTLS_CFLAGS -DGCRYPT_NO_DEPRECATED"
+      AC_DEFINE_UNQUOTED([WITH_GNUTLS_GCRYPT], 1,
+                         [set to 1 if it is known or assumed that GNUTLS uses gcrypt])
+    fi
+
+    AC_CHECK_HEADERS([gnutls/crypto.h], [], [], [[
+      #include <gnutls/gnutls.h>
+    ]])
+
+    AC_CHECK_FUNC([gnutls_rnd])
+    AC_CHECK_FUNC([gnutls_cipher_encrypt])
   fi
-
-  if test "$GNUTLS_GCRYPT" = "probe"; then
-    case $($PKG_CONFIG --libs --static gnutls) in
-      *gcrypt*) GNUTLS_GCRYPT=yes       ;;
-      *nettle*) GNUTLS_GCRYPT=no        ;;
-      *)        GNUTLS_GCRYPT=unknown   ;;
-    esac
-  fi
-
-  if test "$GNUTLS_GCRYPT" = "yes" || test "$GNUTLS_GCRYPT" = "unknown"; then
-    GNUTLS_LIBS="$GNUTLS_LIBS -lgcrypt"
-    dnl We're not using gcrypt deprecated features so define
-    dnl GCRYPT_NO_DEPRECATED to avoid deprecated warnings
-    GNUTLS_CFLAGS="$GNUTLS_CFLAGS -DGCRYPT_NO_DEPRECATED"
-    AC_DEFINE_UNQUOTED([WITH_GNUTLS_GCRYPT], 1,
-                       [set to 1 if it is known or assumed that GNUTLS uses gcrypt])
-  fi
-
-  AC_CHECK_HEADERS([gnutls/crypto.h], [], [], [[
-    #include <gnutls/gnutls.h>
-  ]])
-
-  AC_CHECK_FUNC([gnutls_rnd])
-  AC_CHECK_FUNC([gnutls_cipher_encrypt])
 ])
 
 AC_DEFUN([LIBVIRT_RESULT_GNUTLS],[