diff --git a/sys/kern/kern_clock.c b/sys/kern/kern_clock.c
--- a/sys/kern/kern_clock.c
+++ b/sys/kern/kern_clock.c
@@ -1679,8 +1679,15 @@
 		return (0);
 	case PPS_IOC_KCBIND:
 #ifdef PPS_SYNC
+		/*
+		 * Binding the kernel PPS consumer (hardpps) influences the
+		 * system clock discipline, so require the set-time privilege
+		 * (the same capability used by settimeofday/adjtime).  Resolves
+		 * the long-standing "XXX Only root should be able to do this".
+		 */
+		if (caps_priv_check_self(SYSCAP_NOSETTIME))
+			return (EPERM);
 		kapi = (struct pps_kcbind_args *)data;
-		/* XXX Only root should be able to do this */
 		if (kapi->tsformat && kapi->tsformat != PPS_TSFMT_TSPEC)
 			return (EINVAL);
 		if (kapi->kernel_consumer != PPS_KC_HARDPPS)