diff --git a/cc/config/arm64_device.go b/cc/config/arm64_device.go
index e8b4797..bdcbd05 100644
--- a/cc/config/arm64_device.go
+++ b/cc/config/arm64_device.go
@@ -23,15 +23,8 @@
 
 var (
 	arm64Cflags = []string{
-		"-fstack-protector-strong",
-		"-ffunction-sections",
 		"-fdata-sections",
-		"-funwind-tables",
-		"-Wa,--noexecstack",
-		"-Werror=format-security",
-		"-D_FORTIFY_SOURCE=2",
 		"-fno-short-enums",
-		"-fno-canonical-system-headers",
 
 		// Help catch common 32/64-bit errors.
 		"-Werror=implicit-function-declaration",
@@ -39,7 +32,6 @@
 		"-fno-strict-volatile-bitfields",
 
 		// TARGET_RELEASE_CFLAGS
-		"-Wstrict-aliasing=2",
 		"-fgcse-after-reload",
 		"-frerun-cse-after-loop",
 		"-frename-registers",
diff --git a/cc/config/arm_device.go b/cc/config/arm_device.go
index 8e890ff..3411e07 100644
--- a/cc/config/arm_device.go
+++ b/cc/config/arm_device.go
@@ -28,21 +28,13 @@
 	}
 
 	armCflags = []string{
-		"-ffunction-sections",
 		"-fdata-sections",
-		"-funwind-tables",
-		"-fstack-protector-strong",
-		"-Wa,--noexecstack",
-		"-Werror=format-security",
-		"-D_FORTIFY_SOURCE=2",
 		"-fno-short-enums",
-		"-fno-canonical-system-headers",
 
 		"-fno-builtin-sin",
 		"-fno-strict-volatile-bitfields",
 
 		// TARGET_RELEASE_CFLAGS
-		"-Wstrict-aliasing=2",
 		"-fgcse-after-reload",
 		"-frerun-cse-after-loop",
 		"-frename-registers",
diff --git a/cc/config/global.go b/cc/config/global.go
index 5587eae..4a2f606 100644
--- a/cc/config/global.go
+++ b/cc/config/global.go
@@ -54,12 +54,21 @@
 	deviceGlobalCflags = []string{
 		"-fdiagnostics-color",
 
-		// TARGET_ERROR_FLAGS
+		"-fno-canonical-system-headers",
+		"-ffunction-sections",
+		"-funwind-tables",
+		"-fstack-protector-strong",
+		"-Wa,--noexecstack",
+		"-D_FORTIFY_SOURCE=2",
+
+		"-Wstrict-aliasing=2",
+
 		"-Werror=return-type",
 		"-Werror=non-virtual-dtor",
 		"-Werror=address",
 		"-Werror=sequence-point",
 		"-Werror=date-time",
+		"-Werror=format-security",
 	}
 
 	hostGlobalCflags = []string{}
diff --git a/cc/config/mips64_device.go b/cc/config/mips64_device.go
index 7da693f..9dd1165 100644
--- a/cc/config/mips64_device.go
+++ b/cc/config/mips64_device.go
@@ -25,20 +25,12 @@
 		"-fomit-frame-pointer",
 		"-funswitch-loops",
 		"-Umips",
-		"-ffunction-sections",
 		"-fdata-sections",
-		"-funwind-tables",
-		"-fstack-protector-strong",
-		"-Wa,--noexecstack",
-		"-Werror=format-security",
-		"-D_FORTIFY_SOURCE=2",
-		"-fno-canonical-system-headers",
 
 		// Help catch common 32/64-bit errors.
 		"-Werror=implicit-function-declaration",
 
 		// TARGET_RELEASE_CFLAGS
-		"-Wstrict-aliasing=2",
 		"-fgcse-after-reload",
 		"-frerun-cse-after-loop",
 		"-frename-registers",
diff --git a/cc/config/mips_device.go b/cc/config/mips_device.go
index f8470bf..840702a 100644
--- a/cc/config/mips_device.go
+++ b/cc/config/mips_device.go
@@ -25,17 +25,9 @@
 		"-fomit-frame-pointer",
 		"-funswitch-loops",
 		"-Umips",
-		"-ffunction-sections",
 		"-fdata-sections",
-		"-funwind-tables",
-		"-fstack-protector-strong",
-		"-Wa,--noexecstack",
-		"-Werror=format-security",
-		"-D_FORTIFY_SOURCE=2",
-		"-fno-canonical-system-headers",
 
 		// TARGET_RELEASE_CFLAGS
-		"-Wstrict-aliasing=2",
 		"-fgcse-after-reload",
 		"-frerun-cse-after-loop",
 		"-frename-registers",
diff --git a/cc/config/x86_64_device.go b/cc/config/x86_64_device.go
index 8d7a404..eeb4d2f 100644
--- a/cc/config/x86_64_device.go
+++ b/cc/config/x86_64_device.go
@@ -22,18 +22,10 @@
 
 var (
 	x86_64Cflags = []string{
-		"-Wa,--noexecstack",
-		"-Werror=format-security",
-		"-D_FORTIFY_SOURCE=2",
-		"-Wstrict-aliasing=2",
-		"-ffunction-sections",
 		"-finline-functions",
 		"-finline-limit=300",
 		"-fno-short-enums",
 		"-funswitch-loops",
-		"-funwind-tables",
-		"-fstack-protector-strong",
-		"-fno-canonical-system-headers",
 
 		// Help catch common 32/64-bit errors.
 		"-Werror=implicit-function-declaration",
diff --git a/cc/config/x86_device.go b/cc/config/x86_device.go
index 59f8de7..be36de9 100644
--- a/cc/config/x86_device.go
+++ b/cc/config/x86_device.go
@@ -22,18 +22,10 @@
 
 var (
 	x86Cflags = []string{
-		"-Wa,--noexecstack",
-		"-Werror=format-security",
-		"-D_FORTIFY_SOURCE=2",
-		"-Wstrict-aliasing=2",
-		"-ffunction-sections",
 		"-finline-functions",
 		"-finline-limit=300",
 		"-fno-short-enums",
 		"-funswitch-loops",
-		"-funwind-tables",
-		"-fstack-protector-strong",
-		"-fno-canonical-system-headers",
 	}
 
 	x86ClangCflags = append(x86Cflags, []string{