diff --git a/include/s_serv.h b/include/s_serv.h
index 94e46a47a..04193cb7e 100644
--- a/include/s_serv.h
+++ b/include/s_serv.h
@@ -63,7 +63,6 @@ struct ClientCapability {
 
 /* builtin client capabilities */
 extern unsigned int CLICAP_MULTI_PREFIX;
-extern unsigned int CLICAP_SASL;
 extern unsigned int CLICAP_ACCOUNT_NOTIFY;
 extern unsigned int CLICAP_EXTENDED_JOIN;
 extern unsigned int CLICAP_AWAY_NOTIFY;
diff --git a/ircd/s_serv.c b/ircd/s_serv.c
index 448965a88..4ca1222c2 100644
--- a/ircd/s_serv.c
+++ b/ircd/s_serv.c
@@ -96,7 +96,6 @@ unsigned int CAP_BAN;
 unsigned int CAP_MLOCK;
 
 unsigned int CLICAP_MULTI_PREFIX;
-unsigned int CLICAP_SASL;
 unsigned int CLICAP_ACCOUNT_NOTIFY;
 unsigned int CLICAP_EXTENDED_JOIN;
 unsigned int CLICAP_AWAY_NOTIFY;
@@ -144,7 +143,6 @@ init_builtin_capabs(void)
 	cli_capindex = capability_index_create("client capabilities");
 
 	CLICAP_MULTI_PREFIX = capability_put(cli_capindex, "multi-prefix", NULL);
-	CLICAP_SASL = capability_put(cli_capindex, "sasl", NULL);
 	CLICAP_ACCOUNT_NOTIFY = capability_put(cli_capindex, "account-notify", NULL);
 	CLICAP_EXTENDED_JOIN = capability_put(cli_capindex, "extended-join", NULL);
 	CLICAP_AWAY_NOTIFY = capability_put(cli_capindex, "away-notify", NULL);
diff --git a/modules/m_cap.c b/modules/m_cap.c
index f83b77bce..2619c27cb 100644
--- a/modules/m_cap.c
+++ b/modules/m_cap.c
@@ -59,6 +59,21 @@ DECLARE_MODULE_AV1(cap, NULL, NULL, cap_clist, NULL, NULL, "$Revision: 676 $");
 #define IsCapableEntry(c, e)		IsCapable(c, 1 << (e)->value)
 #define HasCapabilityFlag(c, f)		(c->ownerdata != NULL && (((struct ClientCapability *)c->ownerdata)->flags & (f)) == f)
 
+static inline int
+clicap_visible(const struct CapabilityEntry *cap)
+{
+	struct ClientCapability *clicap;
+
+	if (cap->ownerdata == NULL)
+		return 1;
+
+	clicap = cap->ownerdata;
+	if (clicap->visible == NULL)
+		return 1;
+
+	return clicap->visible();
+}
+
 /* clicap_find()
  *   Used iteratively over a buffer, extracts individual cap tokens.
  *
@@ -165,17 +180,8 @@ clicap_generate(struct Client *source_p, const char *subcmd, int flags, int clea
 				continue;
 		}
 
-		if ((1 << entry->value) == CLICAP_SASL)
-		{
-			struct Client *agent_p = NULL;
-
-			if (!ConfigFileEntry.sasl_service)
-				continue;
-
-			agent_p = find_named_client(ConfigFileEntry.sasl_service);
-			if (agent_p == NULL || !IsService(agent_p))
-				continue;
-		}
+		if (!clicap_visible(entry))
+			continue;
 
 		/* \r\n\0, possible "-~=", space, " *" */
 		if(buflen + strlen(entry->cap) >= BUFSIZE - 10)
@@ -341,22 +347,10 @@ cap_req(struct Client *source_p, const char *arg)
 		}
 		else
 		{
-			if ((1 << cap->value) == CLICAP_SASL)
+			if (!clicap_visible(cap))
 			{
-				struct Client *agent_p = NULL;
-
-				if (!ConfigFileEntry.sasl_service)
-				{
-					finished = 0;
-					break;
-				}
-
-				agent_p = find_named_client(ConfigFileEntry.sasl_service);
-				if (agent_p == NULL || !IsService(agent_p))
-				{
-					finished = 0;
-					break;
-				}
+				finished = 0;
+				break;
 			}
 
 			capadd |= (1 << cap->value);
diff --git a/modules/m_sasl.c b/modules/m_sasl.c
index 84a9a850a..3220ffe9e 100644
--- a/modules/m_sasl.c
+++ b/modules/m_sasl.c
@@ -52,6 +52,8 @@ static void abort_sasl_exit(hook_data_client_exit *);
 static void advertise_sasl(struct Client *);
 static void advertise_sasl_exit(hook_data_client_exit *);
 
+unsigned int CLICAP_SASL = 0;
+
 struct Message authenticate_msgtab = {
 	"AUTHENTICATE", 0, 0, 0, 0,
 	{{m_authenticate, 2}, {m_authenticate, 2}, mg_ignore, mg_ignore, mg_ignore, {m_authenticate, 2}}
@@ -72,7 +74,36 @@ mapi_hfn_list_av1 sasl_hfnlist[] = {
 	{ NULL, NULL }
 };
 
-DECLARE_MODULE_AV1(sasl, NULL, NULL, sasl_clist, NULL, sasl_hfnlist, "$Revision: 1409 $");
+static int
+sasl_visible(void)
+{
+	struct Client *agent_p = NULL;
+
+	if (ConfigFileEntry.sasl_service)
+		agent_p = find_named_client(ConfigFileEntry.sasl_service);
+
+	return agent_p != NULL && IsService(agent_p);
+}
+
+static struct ClientCapability capdata_sasl = {
+	.visible = sasl_visible,
+	.flags = CLICAP_FLAGS_STICKY,
+};
+
+static int
+_modinit(void)
+{
+	CLICAP_SASL = capability_put(cli_capindex, "sasl", &capdata_sasl);
+	return 0;
+}
+
+static void
+_moddeinit(void)
+{
+	capability_orphan(cli_capindex, "sasl");
+}
+
+DECLARE_MODULE_AV1(sasl, _modinit, _moddeinit, sasl_clist, NULL, sasl_hfnlist, "$Revision: 1409 $");
 
 static int
 m_authenticate(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *source_p,