diff --git a/NEWS b/NEWS
index 16389dd9b7..28955144cd 100644
--- a/NEWS
+++ b/NEWS
@@ -31,6 +31,10 @@ Changed Functionality
   code more robust.  External plugins may need to be updated to this
   API change.
 
+- RocksDB support for Broker data stores is now opt-in instead of automatically
+  detected and used at configuration-time.  Use the ``--enable-rocksdb`` and
+  ``--with-rocksdb=`` flags to opt-in.
+
 Removed Functionality
 ---------------------
 
diff --git a/aux/broker b/aux/broker
index ce5fbe3839..15a3b11e31 160000
--- a/aux/broker
+++ b/aux/broker
@@ -1 +1 @@
-Subproject commit ce5fbe3839d684d0bc2f9136b690ead7d6198890
+Subproject commit 15a3b11e31548d6d433ee9b1f3fda6e5e2efd35f
diff --git a/configure b/configure
index d1e9c54ded..48c35e64a5 100755
--- a/configure
+++ b/configure
@@ -54,6 +54,7 @@ Usage: $0 [OPTION]... [VAR=VALUE]...
     --enable-static-broker build Broker statically (ignored if --with-broker is specified)
     --enable-static-binpac build binpac statically (ignored if --with-binpac is specified)
     --enable-cpp-tests     build Zeek's C++ unit tests
+    --enable-rocksdb       try to find a RocksDB installation for use in Broker
     --disable-zeekctl      don't install ZeekControl
     --disable-auxtools     don't build or install auxiliary tools
     --disable-python       don't try to build python bindings for Broker
@@ -85,7 +86,7 @@ Usage: $0 [OPTION]... [VAR=VALUE]...
     --with-python-lib=PATH path to libpython
     --with-python-inc=PATH path to Python headers
     --with-swig=PATH       path to SWIG executable
-    --with-rocksdb=PATH    path to RocksDB installation
+    --with-rocksdb=PATH    path to RocksDB installation, implies --enable-rocksdb
                            (an optional Broker dependency)
 
   Packaging Options (for developers):
@@ -324,7 +325,11 @@ while [ $# -ne 0 ]; do
         --with-libkqueue=*)
             append_cache_entry LIBKQUEUE_ROOT_DIR      PATH   $optarg
             ;;
+        --enable-rocksdb)
+            append_cache_entry BROKER_ENABLE_ROCKSDB BOOL true
+            ;;
         --with-rocksdb=*)
+            append_cache_entry BROKER_ENABLE_ROCKSDB BOOL true
             append_cache_entry ROCKSDB_ROOT_DIR     PATH   $optarg
             ;;
         --binary-package)