diff --git a/src/test/Makefile b/src/test/Makefile
index 69ef074d75..dbd3192874 100644
--- a/src/test/Makefile
+++ b/src/test/Makefile
@@ -17,25 +17,20 @@ SUBDIRS = perl regress isolation modules authentication recovery subscription
 ifeq ($(with_icu),yes)
 SUBDIRS += icu
 endif
-
-# Test suites that are not safe by default but can be run if selected
-# by the user via the whitespace-separated list in variable
-# PG_TEST_EXTRA:
 ifeq ($(with_gssapi),yes)
-ifneq (,$(filter kerberos,$(PG_TEST_EXTRA)))
 SUBDIRS += kerberos
 endif
-endif
 ifeq ($(with_ldap),yes)
-ifneq (,$(filter ldap,$(PG_TEST_EXTRA)))
 SUBDIRS += ldap
 endif
-endif
 ifeq ($(with_ssl),openssl)
-ifneq (,$(filter ssl,$(PG_TEST_EXTRA)))
 SUBDIRS += ssl
 endif
-endif
+
+# Test suites that are not safe by default but can be run if selected
+# by the user via the whitespace-separated list in variable PG_TEST_EXTRA.
+# Export PG_TEST_EXTRA to check it in individual tap tests.
+export PG_TEST_EXTRA
 
 # We don't build or execute these by default, but we do want "make
 # clean" etc to recurse into them.  (We must filter out those that we
diff --git a/src/test/kerberos/t/001_auth.pl b/src/test/kerberos/t/001_auth.pl
index 62e0542639..47169a1d1e 100644
--- a/src/test/kerberos/t/001_auth.pl
+++ b/src/test/kerberos/t/001_auth.pl
@@ -25,6 +25,10 @@ if ($ENV{with_gssapi} ne 'yes')
 {
 	plan skip_all => 'GSSAPI/Kerberos not supported by this build';
 }
+elsif ($ENV{PG_TEST_EXTRA} !~ /\bkerberos\b/)
+{
+	plan skip_all => 'Potentially unsafe test GSSAPI/Kerberos not enabled in PG_TEST_EXTRA';
+}
 
 my ($krb5_bin_dir, $krb5_sbin_dir);
 
diff --git a/src/test/ldap/t/001_auth.pl b/src/test/ldap/t/001_auth.pl
index 86dff8bd1f..2f064f6944 100644
--- a/src/test/ldap/t/001_auth.pl
+++ b/src/test/ldap/t/001_auth.pl
@@ -16,6 +16,10 @@ if ($ENV{with_ldap} ne 'yes')
 {
 	plan skip_all => 'LDAP not supported by this build';
 }
+elsif ($ENV{PG_TEST_EXTRA} !~ /\bldap\b/)
+{
+	plan skip_all => 'Potentially unsafe test LDAP not enabled in PG_TEST_EXTRA';
+}
 elsif ($^O eq 'darwin' && -d '/usr/local/opt/openldap')
 {
 	# typical paths for Homebrew
diff --git a/src/test/ssl/t/001_ssltests.pl b/src/test/ssl/t/001_ssltests.pl
index efab2ac194..c77bc9ef50 100644
--- a/src/test/ssl/t/001_ssltests.pl
+++ b/src/test/ssl/t/001_ssltests.pl
@@ -17,6 +17,10 @@ if ($ENV{with_ssl} ne 'openssl')
 {
 	plan skip_all => 'OpenSSL not supported by this build';
 }
+elsif ($ENV{PG_TEST_EXTRA} !~ /ssl/)
+{
+	plan skip_all => 'Potentially unsafe test SSL not enabled in PG_TEST_EXTRA';
+}
 
 my $ssl_server = SSL::Server->new();
 
diff --git a/src/test/ssl/t/002_scram.pl b/src/test/ssl/t/002_scram.pl
index 588f47a39b..deaa4aa086 100644
--- a/src/test/ssl/t/002_scram.pl
+++ b/src/test/ssl/t/002_scram.pl
@@ -20,6 +20,10 @@ if ($ENV{with_ssl} ne 'openssl')
 {
 	plan skip_all => 'OpenSSL not supported by this build';
 }
+elsif ($ENV{PG_TEST_EXTRA} !~ /\bssl\b/)
+{
+	plan skip_all => 'Potentially unsafe test SSL not enabled in PG_TEST_EXTRA';
+}
 
 my $ssl_server = SSL::Server->new();
 
diff --git a/src/test/ssl/t/003_sslinfo.pl b/src/test/ssl/t/003_sslinfo.pl
index 87fb18a31e..eb0a733a84 100644
--- a/src/test/ssl/t/003_sslinfo.pl
+++ b/src/test/ssl/t/003_sslinfo.pl
@@ -18,6 +18,10 @@ if ($ENV{with_ssl} ne 'openssl')
 {
 	plan skip_all => 'OpenSSL not supported by this build';
 }
+elsif ($ENV{PG_TEST_EXTRA} !~ /\bssl\b/)
+{
+	plan skip_all => 'Potentially unsafe test SSL not enabled in PG_TEST_EXTRA';
+}
 
 #### Some configuration
 my $ssl_server = SSL::Server->new();