diff --git a/apps/wolfssh/README.md b/apps/wolfssh/README.md
index cc368ac4..80bcb276 100644
--- a/apps/wolfssh/README.md
+++ b/apps/wolfssh/README.md
@@ -12,6 +12,11 @@ Phase 2 is going to bring reading the config files `/etc/ssh/ssh_config` and
 `$HOME/.ssh/config`. It will handle OpenSSH style modern keys. It will also
 have support for SSH-AGENT and forwarding.
 
+Every session, terminal or command, runs its I/O on threads, so the client
+needs a threaded wolfSSL. Configuring `--enable-sshclient` against a
+single-threaded wolfSSL is an error, and `--enable-all` leaves the client out
+rather than failing.
+
 Command Line Options
 --------------------
 
diff --git a/apps/wolfssh/wolfssh.c b/apps/wolfssh/wolfssh.c
index a2ebf394..fa916cfd 100644
--- a/apps/wolfssh/wolfssh.c
+++ b/apps/wolfssh/wolfssh.c
@@ -82,8 +82,10 @@
     #include <wolfssl/wolfcrypt/asn.h>
 #endif
 
+/* Every session, terminal or command, runs its I/O on threads. configure
+ * catches this first; the check is here for the builds that don't use it. */
 #ifdef SINGLE_THREADED
-    #error "Threading needed for terminal and command sessions."
+    #error "The wolfSSH client app requires a threaded wolfSSL."
 #endif
 
 
@@ -260,7 +262,7 @@ static void modes_reset(void)
 #define MODES_RESET() do {} while(0)
 #endif /* HAVE_TERMIOS_H && WOLFSSH_TERM */
 
-#if !defined(SINGLE_THREADED) && !defined(WOLFSSL_NUCLEUS)
+#ifndef WOLFSSL_NUCLEUS
 
 #if defined(WOLFSSH_AGENT)
 static inline void ato32(const byte* c, word32* u32)
@@ -657,7 +659,7 @@ static THREAD_RET readPeer(void* in)
 
     return THREAD_RET_SUCCESS;
 }
-#endif /* !SINGLE_THREADED && !WOLFSSL_NUCLEUS */
+#endif /* !WOLFSSL_NUCLEUS */
 
 
 #if defined(WOLFSSL_PTHREADS) && defined(WOLFSSL_TEST_GLOBAL_REQ)
@@ -1152,7 +1154,7 @@ static THREAD_RETURN WOLFSSH_THREAD wolfSSH_Client(void* args)
         MODES_CLEAR();
     }
 
-#if !defined(SINGLE_THREADED) && !defined(WOLFSSL_NUCLEUS)
+#ifndef WOLFSSL_NUCLEUS
 #if 0
     if (keepOpen) /* set up for pseudo-terminal */
         ClientSetEcho(2);
diff --git a/configure.ac b/configure.ac
index 279d491c..80b07a47 100644
--- a/configure.ac
+++ b/configure.ac
@@ -259,6 +259,28 @@ AS_IF([test "x$ENABLED_ALL" = "xyes"],
 AS_IF([test "x$ENABLED_SSHD" = "xyes"],
       [ENABLED_SHELL=yes])
 
+# The client app runs every session's I/O on threads, so it needs a threaded
+# wolfSSL. Probe for the macro rather than trust the flags, it arrives through
+# wolfSSL's options.h. Asking for the client outright is an error; getting it
+# from --enable-all only drops it, so --enable-all still works here.
+AS_IF([test "x$ENABLED_SSHCLIENT" = "xyes"],[
+  AC_MSG_CHECKING([whether wolfSSL is single threaded])
+  AC_COMPILE_IFELSE(
+    [AC_LANG_PROGRAM([[#ifdef WOLFSSL_USER_SETTINGS
+                       #include <wolfssl/wolfcrypt/settings.h>
+                       #else
+                       #include <wolfssl/options.h>
+                       #endif]],
+                     [[#ifndef SINGLE_THREADED
+                       #error "threaded"
+                       #endif]])],
+    [AC_MSG_RESULT([yes])
+     AS_IF([test "x$enable_sshclient" = "xyes"],
+           [AC_MSG_ERROR([--enable-sshclient requires a threaded wolfSSL.])],
+           [AC_MSG_NOTICE([single threaded wolfSSL, not building the ssh client app])
+            ENABLED_SSHCLIENT=no])],
+    [AC_MSG_RESULT([no])])])
+
 # Set the defined flags for the code.
 AS_IF([test "x$ENABLED_INLINE" = "xno"],
       [AM_CPPFLAGS="$AM_CPPFLAGS -DNO_INLINE"])