diff --git a/systemd.spec b/systemd.spec
index 33e1c2b4..64466d96 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -35,8 +35,11 @@
 %define suse_version +suse.82.g117bd7f14a
 %define _testsuitedir /usr/lib/systemd/tests
 
-# Similar to %with but returns true/false
-%define when() %{expand:%%{?with_%{1}:true}%%{!?with_%{1}:false}}
+# Similar to %%with but returns true/false. The 'true' value can be redefined
+# when a second parameter is passed.
+%define __when_1() %{expand:%%{?with_%{1}:true}%%{!?with_%{1}:false}}
+%define __when_2() %{expand:%%{?with_%{1}:%{2}}%%{!?with_%{1}:false}}
+%define when()     %{expand:%%__when_%# %{*}}
 
 %if 0%{?bootstrap}
 %bcond_with     coredump
@@ -673,14 +676,14 @@ Have fun with these services at your own risk.
         -Dresolve=%{when resolved} \
         -Ddns-servers='' \
         -Ddefault-dnssec=no \
-        -Ddns-over-tls=openssl \
+        -Ddns-over-tls=%{when resolved openssl} \
 	\
         -Dpstore=%{when experimental} \
         -Drepart=%{when experimental} \
         -Dhomed=%{when  experimental} \
         -Duserdb=%{when experimental} \
         \
-        -Dtests=%{?with_testsuite:unsafe}%{!?with_testsuite:false} \
+        -Dtests=%{when testsuite unsafe} \
         -Dinstall-tests=%{when testsuite}
 
 %meson_build