diff --git a/.gitignore b/.gitignore
index 5f780fb61..ebfb1b74b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,8 @@ ccan/tools/configurator/configurator
 ccan/ccan/cdump/tools/cdump-enumstr
 libsecp256k1.a
 libsecp256k1.la
+libsodium.a
+libsodium.la
 gen_*
 daemon/lightning-cli
 check-bolt
diff --git a/INSTALL.md b/INSTALL.md
index 4e63bf88a..434bf8eee 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -4,7 +4,6 @@ Library Requirements
 You will need several development libraries:
 * libprotoc: the Google protocol buffer v2 library, 2.6.0 or above.
 * protobuf-c: version 1.1.0 or above.
-* libsodium: for crypto.
 * libsqlite3: for database support.
 * libgmp: for secp256k1
 * asciidoc: for formatting the man page (if you change them)
@@ -17,15 +16,13 @@ To Build on Ubuntu 16.04
 
 Get dependencies:
 ```
-sudo apt-get install autoconf libtool libprotobuf-c-dev libsodium-dev libsqlite3-dev libgmp-dev libsqlite3-dev asciidoc
+sudo apt-get install autoconf libtool libprotobuf-c-dev libsqlite3-dev libgmp-dev libsqlite3-dev asciidoc
 ```
 
-Clone lightning and initialize submodules:
+Clone lightning:
 ```
 git clone https://github.com/ElementsProject/lightning.git
 cd lightning
-git submodule init
-git submodule update
 ```
 
 Build lightning:
@@ -55,12 +52,10 @@ make install
 cd ../
 ```
 
-Clone lightning and initialize submodules:
+Clone lightning:
 ```
 git clone https://github.com/ElementsProject/lightning.git
 cd lighting
-git submodule init
-git submodule update
 ```
 
 Build lightning:
diff --git a/Makefile b/Makefile
index a418ddd28..f88ae78f6 100644
--- a/Makefile
+++ b/Makefile
@@ -193,6 +193,8 @@ CORE_HEADERS := irc.h				\
 GEN_HEADERS := 	gen_version.h			\
 	lightning.pb-c.h
 
+LIBSODIUM_HEADERS := libsodium/src/libsodium/include/sodium.h
+
 CDUMP_OBJS := ccan-cdump.o ccan-strmap.o
 
 WIRE_GEN := tools/generate-wire.py
@@ -209,9 +211,9 @@ PROGRAMS := $(TEST_PROGRAMS)
 
 CWARNFLAGS := -Werror -Wall -Wundef -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wold-style-definition
 CDEBUGFLAGS := -g -fstack-protector
-CFLAGS := $(CWARNFLAGS) $(CDEBUGFLAGS) -I $(CCANDIR) -I secp256k1/include/ -I . $(FEATURES) $(COVFLAGS)
+CFLAGS := $(CWARNFLAGS) $(CDEBUGFLAGS) -I $(CCANDIR) -I secp256k1/include/ -I libsodium/src/libsodium/include/ -I . $(FEATURES) $(COVFLAGS)
 
-LDLIBS := -lprotobuf-c -lgmp -lsodium -lsqlite3 $(COVFLAGS)
+LDLIBS := -lprotobuf-c -lgmp -lsqlite3 $(COVFLAGS)
 $(PROGRAMS): CFLAGS+=-I.
 
 default: $(PROGRAMS) $(MANPAGES) daemon-all
@@ -230,7 +232,7 @@ $(MANPAGES): doc/%: doc/%.txt
 $(CCAN_OBJS) $(CDUMP_OBJS) $(HELPER_OBJS) $(BITCOIN_OBJS) $(TEST_PROGRAMS:=.o) ccan/ccan/cdump/tools/cdump-enumstr.o: $(CCAN_HEADERS)
 
 # Except for CCAN, everything depends on bitcoin/ and core headers.
-$(HELPER_OBJS) $(CORE_OBJS) $(CORE_TX_OBJS) $(CORE_PROTOBUF_OBJS) $(BITCOIN_OBJS) $(LIBBASE58_OBJS) $(WIRE_OBJS) $(TEST_PROGRAMS:=.o): $(BITCOIN_HEADERS) $(CORE_HEADERS) $(CCAN_HEADERS) $(GEN_HEADERS) $(LIBBASE58_HEADERS)
+$(HELPER_OBJS) $(CORE_OBJS) $(CORE_TX_OBJS) $(CORE_PROTOBUF_OBJS) $(BITCOIN_OBJS) $(LIBBASE58_OBJS) $(WIRE_OBJS) $(TEST_PROGRAMS:=.o): $(BITCOIN_HEADERS) $(CORE_HEADERS) $(CCAN_HEADERS) $(GEN_HEADERS) $(LIBBASE58_HEADERS) $(LIBSODIUM_HEADERS)
 
 test-protocol: test/test_protocol
 	set -e; TMP=`mktemp`; for f in test/commits/*.script; do if ! $(VALGRIND) test/test_protocol < $$f > $$TMP; then echo "test/test_protocol < $$f FAILED" >&2; exit 1; fi; diff -u $$TMP $$f.expected; done; rm $$TMP
@@ -308,10 +310,21 @@ secp256k1/libsecp256k1.la:
 	cd secp256k1 && ./autogen.sh && ./configure CC="$(CC)" --enable-static=yes --enable-shared=no --enable-tests=no --enable-experimental=yes --enable-module-ecdh=yes --libdir=`pwd`/..
 	$(MAKE) -C secp256k1 install-exec
 
+# We build libsodium, since Ubuntu xenial has one too old.
+libsodium.a: libsodium/src/libsodium/libsodium.la
+
+libsodium/src/libsodium/include/sodium.h:
+	git submodule update libsodium
+	[ -f $@ ] || git submodule update --init libsodium
+
+libsodium/src/libsodium/libsodium.la: libsodium/src/libsodium/include/sodium.h
+	cd libsodium && ./autogen.sh && ./configure CC="$(CC)" --enable-static=yes --enable-shared=no --enable-tests=no --libdir=`pwd`/..
+	$(MAKE) -C libsodium install-exec
+
 lightning.pb-c.c lightning.pb-c.h: lightning.proto
 	@if $(CHANGED_FROM_GIT); then echo $(PROTOCC) lightning.proto --c_out=.; $(PROTOCC) lightning.proto --c_out=.; else touch $@; fi
 
-$(TEST_PROGRAMS): % : %.o $(BITCOIN_OBJS) $(LIBBASE58_OBJS) $(WIRE_OBJS) $(CCAN_OBJS) utils.o version.o libsecp256k1.a
+$(TEST_PROGRAMS): % : %.o $(BITCOIN_OBJS) $(LIBBASE58_OBJS) $(WIRE_OBJS) $(CCAN_OBJS) utils.o version.o libsecp256k1.a libsodium.a
 
 ccan/config.h: ccan/tools/configurator/configurator
 	if $< > $@.new; then mv $@.new $@; else rm $@.new; exit 1; fi
@@ -366,6 +379,7 @@ update-secp256k1:
 distclean: clean
 	$(MAKE) -C secp256k1/ distclean || true
 	$(RM) libsecp256k1.a secp256k1/libsecp256k1.la
+	$(RM) libsodium.a libsodium/libsodium.la
 
 maintainer-clean: distclean
 	@echo 'This command is intended for maintainers to use; it'
@@ -377,6 +391,7 @@ maintainer-clean: distclean
 clean: daemon-clean wire-clean
 	$(MAKE) -C secp256k1/ clean || true
 	$(RM) libsecp256k1.{a,la}
+	$(RM) libsodium.{a,la}
 	$(RM) $(PROGRAMS)
 	$(RM) bitcoin/*.o *.o $(PROGRAMS:=.o) $(CCAN_OBJS)
 	$(RM) ccan/config.h gen_*.h
diff --git a/daemon/Makefile b/daemon/Makefile
index c4931a1bb..184f65579 100644
--- a/daemon/Makefile
+++ b/daemon/Makefile
@@ -115,7 +115,7 @@ daemon/gen_state_names.h: daemon/state_types.h ccan/ccan/cdump/tools/cdump-enums
 daemon/gen_pkt_names.h: lightning.pb-c.h ccan/ccan/cdump/tools/cdump-enumstr
 	(echo 'enum PktCase {'; grep '^  PKT__' lightning.pb-c.h; echo '};') | 	ccan/ccan/cdump/tools/cdump-enumstr - | sed 's/enum PktCase/Pkt__PktCase/' > $@
 
-$(DAEMON_OBJS) $(DAEMON_LIB_OBJS) $(DAEMON_CLI_OBJS): $(DAEMON_HEADERS) $(DAEMON_JSMN_HEADERS) $(BITCOIN_HEADERS) $(CORE_HEADERS) $(CORE_TX_HEADERS) $(GEN_HEADERS) $(DAEMON_GEN_HEADERS) $(CCAN_HEADERS) $(WIRE_HEADERS) $(WIRE_GEN_HEADERS)
+$(DAEMON_OBJS) $(DAEMON_LIB_OBJS) $(DAEMON_CLI_OBJS): $(DAEMON_HEADERS) $(DAEMON_JSMN_HEADERS) $(BITCOIN_HEADERS) $(CORE_HEADERS) $(CORE_TX_HEADERS) $(GEN_HEADERS) $(DAEMON_GEN_HEADERS) $(CCAN_HEADERS) $(WIRE_HEADERS) $(WIRE_GEN_HEADERS) $(LIBSODIUM_HEADERS) $(LIBBASE58_HEADERS)
 $(DAEMON_JSMN_OBJS): $(DAEMON_JSMN_HEADERS)
 
 check-source: $(DAEMON_SRC:%=check-src-include-order/%)
@@ -145,9 +145,9 @@ daemon/jsmn/jsmn.c: daemon/jsmn/jsmn.h
 daemon/jsmn.o: daemon/jsmn/jsmn.c
 	$(COMPILE.c) -DJSMN_STRICT=1 $(OUTPUT_OPTION) $<
 
-daemon/lightningd: $(DAEMON_OBJS) $(DAEMON_LIB_OBJS) $(DAEMON_JSMN_OBJS) $(CORE_OBJS)  $(CORE_TX_OBJS) $(CORE_PROTOBUF_OBJS) $(BITCOIN_OBJS) $(LIBBASE58_OBJS) $(WIRE_OBJS) $(CCAN_OBJS) libsecp256k1.a
+daemon/lightningd: $(DAEMON_OBJS) $(DAEMON_LIB_OBJS) $(DAEMON_JSMN_OBJS) $(CORE_OBJS)  $(CORE_TX_OBJS) $(CORE_PROTOBUF_OBJS) $(BITCOIN_OBJS) $(LIBBASE58_OBJS) $(WIRE_OBJS) $(CCAN_OBJS) libsecp256k1.a libsodium.a
 
-daemon/lightning-cli: $(DAEMON_CLI_OBJS) $(DAEMON_LIB_OBJS) $(DAEMON_JSMN_OBJS) $(CORE_OBJS) $(BITCOIN_OBJS) $(LIBBASE58_OBJS) $(WIRE_OBJS) $(CCAN_OBJS) libsecp256k1.a
+daemon/lightning-cli: $(DAEMON_CLI_OBJS) $(DAEMON_LIB_OBJS) $(DAEMON_JSMN_OBJS) $(CORE_OBJS) $(BITCOIN_OBJS) $(LIBBASE58_OBJS) $(WIRE_OBJS) $(CCAN_OBJS) libsecp256k1.a libsodium.a
 
 daemon-clean:
 	$(RM) $(DAEMON_OBJS) $(DAEMON_LIB_OBJS) $(DAEMON_CLI_OBJS) $(DAEMON_JSMN_OBJS) $(DAEMON_GEN_HEADERS)
diff --git a/daemon/test/Makefile b/daemon/test/Makefile
index 54a7355da..f22fe7025 100644
--- a/daemon/test/Makefile
+++ b/daemon/test/Makefile
@@ -63,7 +63,7 @@ DAEMON_TEST_PROGRAMS := $(DAEMON_TEST_OBJS:.o=)
 
 update-mocks: $(DAEMON_TEST_SRC:%=update-mocks/%)
 
-$(DAEMON_TEST_PROGRAMS): $(CCAN_OBJS) $(BITCOIN_OBJS) $(CORE_OBJS) $(CORE_TX_OBJS) $(CORE_PROTOBUF_OBJS) $(LIBBASE58_OBJS) $(WIRE_OBJS) libsecp256k1.a utils.o
+$(DAEMON_TEST_PROGRAMS): $(CCAN_OBJS) $(BITCOIN_OBJS) $(CORE_OBJS) $(CORE_TX_OBJS) $(CORE_PROTOBUF_OBJS) $(LIBBASE58_OBJS) $(WIRE_OBJS) libsecp256k1.a libsodium.a utils.o
 
 $(DAEMON_TEST_OBJS): $(DAEMON_HEADERS) $(DAEMON_JSMN_HEADERS) $(BITCOIN_HEADERS) $(CORE_HEADERS) $(CORE_TX_HEADERS) $(GEN_HEADERS) $(DAEMON_GEN_HEADERS) $(CCAN_HEADERS) $(WIRE_HEADERS)
 
diff --git a/lightningd/Makefile b/lightningd/Makefile
index 628027a74..b71822ac6 100644
--- a/lightningd/Makefile
+++ b/lightningd/Makefile
@@ -51,7 +51,7 @@ LIGHTNINGD_HEADERS =				\
 	lightningd/peer_control.h		\
 	lightningd/subdaemon.h
 
-$(LIGHTNINGD_OBJS) $(LIGHTNINGD_LIB_OBJS): $(LIGHTNINGD_HEADERS) $(LIGHTNINGD_JSMN_HEADERS) $(BITCOIN_HEADERS) $(CORE_HEADERS) $(GEN_HEADERS) $(CCAN_HEADERS) $(DAEMON_HEADERS) $(LIGHTNINGD_HSM_CONTROL_HEADERS) $(LIGHTNINGD_HANDSHAKE_CONTROL_HEADERS) $(LIBBASE58_HEADERS)
+$(LIGHTNINGD_OBJS) $(LIGHTNINGD_LIB_OBJS): $(LIGHTNINGD_HEADERS) $(LIGHTNINGD_JSMN_HEADERS) $(BITCOIN_HEADERS) $(CORE_HEADERS) $(GEN_HEADERS) $(CCAN_HEADERS) $(DAEMON_HEADERS) $(LIGHTNINGD_HSM_CONTROL_HEADERS) $(LIGHTNINGD_HANDSHAKE_CONTROL_HEADERS) $(LIBBASE58_HEADERS) $(LIBSODIUM_HEADERS)
 
 include lightningd/hsm/Makefile
 include lightningd/handshake/Makefile
@@ -68,7 +68,7 @@ check-whitespace: $(LIGHTNINGD_SRC:%=check-whitespace/%) $(LIGHTNINGD_HEADERS:%=
 check-lightningd-makefile:
 	@if [ "`ls lightningd/*.h | grep -v lightningd/gen | tr '\012' ' '`" != "`echo $(LIGHTNINGD_HEADERS) ''`" ]; then echo LIGHTNINGD_HEADERS incorrect; exit 1; fi
 
-lightningd/lightningd: $(LIGHTNINGD_OBJS) $(LIGHTNINGD_OLD_OBJS) $(LIGHTNINGD_LIB_OBJS) $(LIGHTNINGD_JSMN_OBJS) $(CORE_OBJS) $(BITCOIN_OBJS) $(WIRE_OBJS) $(CCAN_OBJS) $(LIGHTNINGD_HSM_CONTROL_OBJS) $(LIGHTNINGD_HANDSHAKE_CONTROL_OBJS) $(LIGHTNINGD_GOSSIP_CONTROL_OBJS) $(LIBBASE58_OBJS) libsecp256k1.a
+lightningd/lightningd: $(LIGHTNINGD_OBJS) $(LIGHTNINGD_OLD_OBJS) $(LIGHTNINGD_LIB_OBJS) $(LIGHTNINGD_JSMN_OBJS) $(CORE_OBJS) $(BITCOIN_OBJS) $(WIRE_OBJS) $(CCAN_OBJS) $(LIGHTNINGD_HSM_CONTROL_OBJS) $(LIGHTNINGD_HANDSHAKE_CONTROL_OBJS) $(LIGHTNINGD_GOSSIP_CONTROL_OBJS) $(LIBBASE58_OBJS) libsecp256k1.a libsodium.a
 
 clean: lightningd-clean
 
diff --git a/lightningd/gossip/Makefile b/lightningd/gossip/Makefile
index 7e222b515..f4f25c8cc 100644
--- a/lightningd/gossip/Makefile
+++ b/lightningd/gossip/Makefile
@@ -27,11 +27,11 @@ LIGHTNINGD_GOSSIP_ALLHEADERS_NOGEN := $(filter-out lightningd/gossip/gen_%, $(LI
 # Add to headers which any object might need.
 LIGHTNINGD_HEADERS += $(LIGHTNINGD_GOSSIP_HEADERS)
 
-$(LIGHTNINGD_GOSSIP_OBJS) $(LIGHTNINGD_GOSSIP_CLIENT_OBJS): $(CCAN_HEADERS) $(CORE_HEADERS) $(BITCOIN_HEADERS) $(GEN_HEADERS) $(WIRE_HEADERS) $(LIGHTNINGD_GOSSIP_HEADERS) $(LIGHTNINGD_GOSSIP_GEN_HEADERS) $(LIGHTNINGD_LIB_HEADERS) $(LIBBASE58_HEADERS) $(LIGHTNINGD_HEADERS)
+$(LIGHTNINGD_GOSSIP_OBJS) $(LIGHTNINGD_GOSSIP_CLIENT_OBJS): $(CCAN_HEADERS) $(CORE_HEADERS) $(BITCOIN_HEADERS) $(GEN_HEADERS) $(WIRE_HEADERS) $(LIGHTNINGD_GOSSIP_HEADERS) $(LIGHTNINGD_GOSSIP_GEN_HEADERS) $(LIGHTNINGD_LIB_HEADERS) $(LIBBASE58_HEADERS) $(LIGHTNINGD_HEADERS) $(LIBSODIUM_HEADERS)
 
 lightningd/gossip-all: lightningd/lightningd_gossip $(LIGHTNINGD_GOSSIP_CLIENT_OBJS)
 
-lightningd/lightningd_gossip: $(LIGHTNINGD_GOSSIP_OBJS) $(CORE_OBJS) $(BITCOIN_OBJS) $(WIRE_OBJS) $(CCAN_OBJS) $(LIGHTNINGD_LIB_OBJS) $(LIBBASE58_OBJS) libsecp256k1.a
+lightningd/lightningd_gossip: $(LIGHTNINGD_GOSSIP_OBJS) $(CORE_OBJS) $(BITCOIN_OBJS) $(WIRE_OBJS) $(CCAN_OBJS) $(LIGHTNINGD_LIB_OBJS) $(LIBBASE58_OBJS) libsecp256k1.a libsodium.a
 	$(CC) $(CFLAGS) -o $@ $^ $(LDLIBS)
 
 lightningd/gossip/gen_gossip_control_wire.h: $(WIRE_GEN) lightningd/gossip/gossip_control_wire_csv
diff --git a/lightningd/handshake/Makefile b/lightningd/handshake/Makefile
index ad83a3948..005c6e235 100644
--- a/lightningd/handshake/Makefile
+++ b/lightningd/handshake/Makefile
@@ -28,7 +28,7 @@ LIGHTNINGD_HANDSHAKE_SRC_NOGEN := $(filter-out lightningd/handshake/gen_%, $(LIG
 # Add to headers which any object might need.
 LIGHTNINGD_HEADERS += $(LIGHTNINGD_HANDSHAKE_HEADERS)
 
-$(LIGHTNINGD_HANDSHAKE_OBJS): $(CCAN_HEADERS) $(CORE_HEADERS) $(GEN_HEADERS) $(WIRE_HEADERS) $(BITCOIN_HEADERS) $(LIGHTNINGD_HANDSHAKE_HEADERS) $(LIGHTNINGD_HSM_CLIENT_HEADERS) $(LIBBASE58_HEADERS) $(LIGHTNINGD_HEADERS)
+$(LIGHTNINGD_HANDSHAKE_OBJS): $(CCAN_HEADERS) $(CORE_HEADERS) $(GEN_HEADERS) $(WIRE_HEADERS) $(BITCOIN_HEADERS) $(LIGHTNINGD_HANDSHAKE_HEADERS) $(LIGHTNINGD_HSM_CLIENT_HEADERS) $(LIBBASE58_HEADERS) $(LIGHTNINGD_HEADERS) $(LIBSODIUM_HEADERS)
 
 lightningd/handshake/gen_handshake_control_wire.h: $(WIRE_GEN) lightningd/handshake/handshake_control_wire_csv
 	$(WIRE_GEN) --header $@ handshake_control_wire_type < lightningd/handshake/handshake_control_wire_csv > $@
@@ -44,7 +44,7 @@ lightningd/handshake/gen_handshake_status_wire.c: $(WIRE_GEN) lightningd/handsha
 
 LIGHTNINGD_HANDSHAKE_OBJS := $(LIGHTNINGD_HANDSHAKE_SRC:.c=.o) $(LIGHTNINGD_HANDSHAKE_GEN_SRC:.c=.o)
 
-lightningd/lightningd_handshake: $(LIGHTNINGD_LIB_OBJS) $(LIGHTNINGD_HANDSHAKE_OBJS) $(CORE_OBJS) $(WIRE_OBJS) $(BITCOIN_OBJS) $(CCAN_OBJS) $(LIGHTNINGD_HSM_CLIENT_OBJS) $(LIBBASE58_OBJS) libsecp256k1.a
+lightningd/lightningd_handshake: $(LIGHTNINGD_LIB_OBJS) $(LIGHTNINGD_HANDSHAKE_OBJS) $(CORE_OBJS) $(WIRE_OBJS) $(BITCOIN_OBJS) $(CCAN_OBJS) $(LIGHTNINGD_HSM_CLIENT_OBJS) $(LIBBASE58_OBJS) libsecp256k1.a libsodium.a
 	$(CC) $(CFLAGS) -o $@ $^ $(LDLIBS)
 
 check-source: $(LIGHTNINGD_HANDSHAKE_SRC_NOGEN:%=check-src-include-order/%)
diff --git a/lightningd/handshake/test/Makefile b/lightningd/handshake/test/Makefile
index 9ddd9a47c..e9454d270 100644
--- a/lightningd/handshake/test/Makefile
+++ b/lightningd/handshake/test/Makefile
@@ -8,9 +8,9 @@ LIGHTNINGD_HANDSHAKE_TEST_PROGRAMS := $(LIGHTNINGD_HANDSHAKE_TEST_OBJS:.o=)
 
 update-mocks: $(LIGHTNINGD_HANDSHAKE_TEST_SRC:%=update-mocks/%)
 
-$(LIGHTNINGD_HANDSHAKE_TEST_PROGRAMS): $(CCAN_OBJS) $(BITCOIN_OBJS) $(CORE_OBJS) $(WIRE_OBJS) $(LIBBASE58_OBJS) $(LIGHTNINGD_LIB_OBJS) libsecp256k1.a utils.o $(LIGHTNINGD_HANDSHAKE_GEN_SRC:.c=.o)
+$(LIGHTNINGD_HANDSHAKE_TEST_PROGRAMS): $(CCAN_OBJS) $(BITCOIN_OBJS) $(CORE_OBJS) $(WIRE_OBJS) $(LIBBASE58_OBJS) $(LIGHTNINGD_LIB_OBJS) libsecp256k1.a libsodium.a utils.o $(LIGHTNINGD_HANDSHAKE_GEN_SRC:.c=.o)
 
-$(LIGHTNINGD_HANDSHAKE_TEST_OBJS): $(LIGHTNINGD_HANDSHAKE_HEADERS) $(LIGHTNINGD_LIB_HEADERS) $(BITCOIN_HEADERS) $(CORE_HEADERS) $(GEN_HEADERS) $(WIRE_HEADERS) $(CCAN_HEADERS) $(LIBBASE58_HEADERS) 
+$(LIGHTNINGD_HANDSHAKE_TEST_OBJS): $(LIGHTNINGD_HANDSHAKE_HEADERS) $(LIGHTNINGD_LIB_HEADERS) $(BITCOIN_HEADERS) $(CORE_HEADERS) $(GEN_HEADERS) $(WIRE_HEADERS) $(CCAN_HEADERS) $(LIBBASE58_HEADERS) $(LIBSODIUM_HEADERS)
 
 lightningd/handshake-tests: $(LIGHTNINGD_HANDSHAKE_TEST_PROGRAMS:%=unittest/%)
 
diff --git a/lightningd/hsm/Makefile b/lightningd/hsm/Makefile
index 88ff6d1d8..ffaf383d1 100644
--- a/lightningd/hsm/Makefile
+++ b/lightningd/hsm/Makefile
@@ -37,7 +37,7 @@ $(LIGHTNINGD_HSM_OBJS) $(LIGHTNINGD_HSM_CLIENT_OBJS): $(CCAN_HEADERS) $(CORE_HEA
 
 lightningd/hsm-all: lightningd/lightningd_hsm $(LIGHTNINGD_HSM_CLIENT_OBJS)
 
-lightningd/lightningd_hsm: $(LIGHTNINGD_HSM_OBJS) $(CORE_OBJS) $(BITCOIN_OBJS) $(WIRE_OBJS) $(CCAN_OBJS) $(LIBBASE58_OBJS) libsecp256k1.a
+lightningd/lightningd_hsm: $(LIGHTNINGD_HSM_OBJS) $(CORE_OBJS) $(BITCOIN_OBJS) $(WIRE_OBJS) $(CCAN_OBJS) $(LIBBASE58_OBJS) libsecp256k1.a libsodium.a
 	$(CC) $(CFLAGS) -o $@ $^ $(LDLIBS)
 
 lightningd/hsm/gen_hsm_client_wire.h: $(WIRE_GEN) lightningd/hsm/hsm_client_wire_csv
diff --git a/lightningd/test/Makefile b/lightningd/test/Makefile
index fa0f9c33d..518326a2b 100644
--- a/lightningd/test/Makefile
+++ b/lightningd/test/Makefile
@@ -11,7 +11,7 @@ LIGHTNINGD_TEST_PROGRAMS := $(LIGHTNINGD_TEST_OBJS:.o=)
 
 update-mocks: $(LIGHTNINGD_TEST_SRC:%=update-mocks/%)
 
-$(LIGHTNINGD_TEST_PROGRAMS): $(CCAN_OBJS) $(BITCOIN_OBJS) $(WIRE_OBJS) $(LIBBASE58_OBJS) libsecp256k1.a utils.o $(LIGHTNINGD_HANDSHAKE_GEN_SRC:.c=.o)
+$(LIGHTNINGD_TEST_PROGRAMS): $(CCAN_OBJS) $(BITCOIN_OBJS) $(WIRE_OBJS) $(LIBBASE58_OBJS) $(LIGHTNINGD_HANDSHAKE_GEN_SRC:.c=.o) utils.o libsecp256k1.a libsodium.a
 
 $(LIGHTNINGD_TEST_OBJS): $(LIGHTNINGD_HEADERS) $(BITCOIN_HEADERS) $(CORE_HEADERS) $(GEN_HEADERS) $(WIRE_HEADERS) $(CCAN_HEADERS) $(LIBBASE58_HEADERS)
 
diff --git a/wire/test/Makefile b/wire/test/Makefile
index ff3da731d..324cee4cc 100644
--- a/wire/test/Makefile
+++ b/wire/test/Makefile
@@ -8,9 +8,9 @@ WIRE_TEST_PROGRAMS := $(WIRE_TEST_OBJS:.o=)
 
 update-mocks: $(WIRE_TEST_SRC:%=update-mocks/%)
 
-$(WIRE_TEST_PROGRAMS): $(CCAN_OBJS) $(BITCOIN_OBJS) $(LIBBASE58_OBJS) libsecp256k1.a utils.o
+$(WIRE_TEST_PROGRAMS): $(CCAN_OBJS) $(BITCOIN_OBJS) $(LIBBASE58_OBJS) libsecp256k1.a utils.o libsodium.a
 
-$(WIRE_TEST_OBJS): $(WIRE_HEADERS) $(BITCOIN_HEADERS) $(CORE_HEADERS) $(GEN_HEADERS) $(WIRE_GEN_HEADERS) $(WIRE_GEN_SRC) $(CCAN_HEADERS)
+$(WIRE_TEST_OBJS): $(WIRE_HEADERS) $(BITCOIN_HEADERS) $(CORE_HEADERS) $(GEN_HEADERS) $(WIRE_GEN_HEADERS) $(WIRE_GEN_SRC) $(CCAN_HEADERS) $(LIBSODIUM_HEADERS)
 
 wire-tests: $(WIRE_TEST_PROGRAMS:%=unittest/%)