diff --git a/NEWS b/NEWS
index 99b17ef60bc..d56b7a6f274 100644
--- a/NEWS
+++ b/NEWS
@@ -55,8 +55,9 @@ CHANGES WITH 234:
           option.
 
         * systemd-resolved may now optionally use libidn2 instead of the libidn
-          for processing internationalized domain names. The old version
-          remains supported, as it has a much smaller footprint.
+          for processing internationalized domain names. Support for libidn2
+          should be considered experimental and should not be enabled by
+          default yet.
 
         * "machinectl pull-tar" and related call may now do verification of
           downloaded images using SUSE-style .sha256 checksum files in addition
diff --git a/configure.ac b/configure.ac
index 754615ebb8f..c7537aafc0c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1019,36 +1019,36 @@ AM_CONDITIONAL(HAVE_LIBCURL, [test "$have_libcurl" = "yes"])
 AM_CONDITIONAL(HAVE_REMOTE, [test "$have_microhttpd" = "yes" -o "$have_libcurl" = "yes"])
 
 # ------------------------------------------------------------------------------
-have_libidn2=no
-AC_ARG_ENABLE(libidn2, AS_HELP_STRING([--disable-libidn2], [disable optional LIBIDN2 support]))
-if test "x$enable_libidn2" != "xno"; then
-        PKG_CHECK_MODULES(LIBIDN2, [libidn2 >= 2.0.0],
-               [AC_DEFINE(HAVE_LIBIDN2, 1, [Define if libidn2 is available])
-                have_libidn2=yes
-                M4_DEFINES="$M4_DEFINES -DHAVE_LIBIDN2"],
-               [have_libidn2=no])
-        if test "x$have_libidn2" = "xno" -a "x$enable_libidn2" = "xyes"; then
-                AC_MSG_ERROR([*** libidn2 support requested but libraries not found])
-        fi
-fi
-AM_CONDITIONAL(HAVE_LIBIDN2, [test "$have_libidn2" = "yes"])
-
 have_libidn=no
 AC_ARG_ENABLE(libidn, AS_HELP_STRING([--disable-libidn], [disable optional LIBIDN support]))
-if test "$have_libidn2" != "yes"; then
-        if test "x$enable_libidn" != "xno"; then
-                PKG_CHECK_MODULES(LIBIDN, [libidn],
-                       [AC_DEFINE(HAVE_LIBIDN, 1, [Define if libidn is available])
-                        have_libidn=yes
-                        M4_DEFINES="$M4_DEFINES -DHAVE_LIBIDN"],
-                       [have_libidn=no])
-                if test "x$have_libidn" = "xno" -a "x$enable_libidn" = "xyes"; then
-                        AC_MSG_ERROR([*** libidn support requested but libraries not found])
-                fi
+if test "x$enable_libidn" != "xno"; then
+        PKG_CHECK_MODULES(LIBIDN, [libidn],
+               [AC_DEFINE(HAVE_LIBIDN, 1, [Define if libidn is available])
+                have_libidn=yes
+                M4_DEFINES="$M4_DEFINES -DHAVE_LIBIDN"],
+               [have_libidn=no])
+        if test "x$have_libidn" = "xno" -a "x$enable_libidn" = "xyes"; then
+                AC_MSG_ERROR([*** libidn support requested but libraries not found])
         fi
 fi
 AM_CONDITIONAL(HAVE_LIBIDN, [test "$have_libidn" = "yes"])
 
+have_libidn2=no
+AC_ARG_ENABLE(libidn2, AS_HELP_STRING([--disable-libidn2], [disable optional LIBIDN2 support]))
+if test "$have_libidn" != "yes"; then
+        if test "x$enable_libidn2" != "xno"; then
+                PKG_CHECK_MODULES(LIBIDN2, [libidn2 >= 2.0.0],
+                       [AC_DEFINE(HAVE_LIBIDN2, 1, [Define if libidn2 is available])
+                        have_libidn2=yes
+                        M4_DEFINES="$M4_DEFINES -DHAVE_LIBIDN2"],
+                       [have_libidn2=no])
+                if test "x$have_libidn2" = "xno" -a "x$enable_libidn2" = "xyes"; then
+                        AC_MSG_ERROR([*** libidn2 support requested but libraries not found])
+                fi
+        fi
+fi
+AM_CONDITIONAL(HAVE_LIBIDN2, [test "$have_libidn2" = "yes"])
+
 # ------------------------------------------------------------------------------
 have_idn=no
 AC_ARG_ENABLE(idn, AS_HELP_STRING([--disable-idn], [disable IDN when printing host names]))
diff --git a/meson.build b/meson.build
index 22fc8f5b525..20b27c86001 100644
--- a/meson.build
+++ b/meson.build
@@ -796,24 +796,24 @@ if want_libidn == 'true' and want_libidn2 == 'true'
         error('libidn and libidn2 cannot be requested simultaneously')
 endif
 
-if want_libidn2 != 'false' and want_libidn != 'true'
-        libidn = dependency('libidn2',
-                            required : want_libidn2 == 'true')
-        # libidn is used for both libidn and libidn2 objects
-        if libidn.found()
-                conf.set('HAVE_LIBIDN2', true)
-                m4_defines += ['-DHAVE_LIBIDN2']
-        endif
-else
-        libidn = []
-endif
-if not conf.get('HAVE_LIBIDN2', false) and want_libidn != 'false'
+if want_libidn != 'false' and want_libidn2 != 'true'
         libidn = dependency('libidn',
                             required : want_libidn == 'true')
         if libidn.found()
                 conf.set('HAVE_LIBIDN', true)
                 m4_defines += ['-DHAVE_LIBIDN']
         endif
+else
+        libidn = []
+endif
+if not conf.get('HAVE_LIBIDN', false) and want_libidn2 != 'false'
+        # libidn is used for both libidn and libidn2 objects
+        libidn = dependency('libidn2',
+                            required : want_libidn2 == 'true')
+        if libidn.found()
+                conf.set('HAVE_LIBIDN2', true)
+                m4_defines += ['-DHAVE_LIBIDN2']
+        endif
 endif
 
 want_libiptc = get_option('libiptc')