diff --git a/cc/lto.go b/cc/lto.go
index 7bc22ec..91b11b5 100644
--- a/cc/lto.go
+++ b/cc/lto.go
@@ -82,7 +82,8 @@
 		flags.LdFlags = append(flags.LdFlags, ltoFlag)
 		if ctx.Device() {
 			// Work around bug in Clang that doesn't pass correct emulated
-			// TLS option to target
+			// TLS option to target. See b/72706604 or
+			// https://github.com/android-ndk/ndk/issues/498.
 			flags.LdFlags = append(flags.LdFlags, "-Wl,-plugin-opt,-emulated-tls")
 		}
 		flags.ArFlags = append(flags.ArFlags, " --plugin ${config.LLVMGoldPlugin}")
diff --git a/cc/sanitize.go b/cc/sanitize.go
index 02aedc8..ac6cb77 100644
--- a/cc/sanitize.go
+++ b/cc/sanitize.go
@@ -401,6 +401,12 @@
 			flags.CFlags = append(flags.CFlags, "-fvisibility=default")
 		}
 		flags.LdFlags = append(flags.LdFlags, cfiLdflags...)
+		if ctx.Device() {
+			// Work around a bug in Clang. The CFI sanitizer requires LTO, and when
+			// LTO is enabled, the Clang driver fails to enable emutls for Android.
+			// See b/72706604 or https://github.com/android-ndk/ndk/issues/498.
+			flags.LdFlags = append(flags.LdFlags, "-Wl,-plugin-opt,-emulated-tls")
+		}
 		flags.ArFlags = append(flags.ArFlags, cfiArflags...)
 		if Bool(sanitize.Properties.Sanitize.Diag.Cfi) {
 			diagSanitizers = append(diagSanitizers, "cfi")