diff --git a/ChangeLog.d/fix-ENABLE_PROGRAMS-bug.txt b/ChangeLog.d/fix-ENABLE_PROGRAMS-bug.txt
new file mode 100644
index 0000000000..c7658ec0b6
--- /dev/null
+++ b/ChangeLog.d/fix-ENABLE_PROGRAMS-bug.txt
@@ -0,0 +1,2 @@
+Bugfix
+   * Fix failure of cmake -DENABLE_PROGRAMS=OFF. Fixes #10587.
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index bdb30ee443..cf7a2703b1 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -140,7 +140,9 @@ if(GEN_FILES)
     add_custom_target(handshake-generated.sh
         DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/opt-testcases/handshake-generated.sh)
     set_target_properties(handshake-generated.sh PROPERTIES EXCLUDE_FROM_ALL NO)
+if(ENABLE_PROGRAMS)
     add_dependencies(${ssl_opt_target} handshake-generated.sh)
+endif()
 
     add_custom_command(
         OUTPUT
@@ -195,8 +197,11 @@ if(GEN_FILES)
     )
     add_custom_target(tls13-compat.sh
         DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/opt-testcases/tls13-compat.sh)
+
+if(ENABLE_PROGRAMS)
     set_target_properties(tls13-compat.sh PROPERTIES EXCLUDE_FROM_ALL NO)
     add_dependencies(${ssl_opt_target} tls13-compat.sh)
+endif()
 
 else()
     foreach(file ${all_generated_data_files})