diff --git a/cc/arm64_device.go b/cc/arm64_device.go
index 157b273..c861498 100644
--- a/cc/arm64_device.go
+++ b/cc/arm64_device.go
@@ -25,7 +25,7 @@
 		"-fno-exceptions", // from build/core/combo/select.mk
 		"-Wno-multichar",  // from build/core/combo/select.mk
 		"-fno-strict-aliasing",
-		"-fstack-protector",
+		"-fstack-protector-strong",
 		"-ffunction-sections",
 		"-fdata-sections",
 		"-funwind-tables",
@@ -61,6 +61,8 @@
 		"-Wl,-maarch64linux",
 		"-Wl,--hash-style=gnu",
 		"-Wl,--fix-cortex-a53-843419",
+		"-fuse-ld=gold",
+		"-Wl,--icf=safe",
 		"-Wl,--no-undefined-version",
 
 		// Disable transitive dependency library symbol resolving.
diff --git a/cc/arm_device.go b/cc/arm_device.go
index d44787d..7212c4f 100644
--- a/cc/arm_device.go
+++ b/cc/arm_device.go
@@ -33,7 +33,7 @@
 		"-ffunction-sections",
 		"-fdata-sections",
 		"-funwind-tables",
-		"-fstack-protector",
+		"-fstack-protector-strong",
 		"-Wa,--noexecstack",
 		"-Werror=format-security",
 		"-D_FORTIFY_SOURCE=2",
diff --git a/cc/clang.go b/cc/clang.go
index 6762247..6a01010 100644
--- a/cc/clang.go
+++ b/cc/clang.go
@@ -41,7 +41,6 @@
 
 	// arm + arm64
 	"-fno-align-jumps",
-	"-Wa,--noexecstack",
 
 	// arm
 	"-mthumb-interwork",
diff --git a/cc/mips64_device.go b/cc/mips64_device.go
index a0e39a6..8e433c6 100644
--- a/cc/mips64_device.go
+++ b/cc/mips64_device.go
@@ -34,6 +34,7 @@
 		"-ffunction-sections",
 		"-fdata-sections",
 		"-funwind-tables",
+		"-fstack-protector-strong",
 		"-Wa,--noexecstack",
 		"-Werror=format-security",
 		"-D_FORTIFY_SOURCE=2",
diff --git a/cc/mips_device.go b/cc/mips_device.go
index f668f22..d88c906 100644
--- a/cc/mips_device.go
+++ b/cc/mips_device.go
@@ -34,6 +34,7 @@
 		"-ffunction-sections",
 		"-fdata-sections",
 		"-funwind-tables",
+		"-fstack-protector-strong",
 		"-Wa,--noexecstack",
 		"-Werror=format-security",
 		"-D_FORTIFY_SOURCE=2",
diff --git a/cc/x86_64_device.go b/cc/x86_64_device.go
index 9c79d87..4ae6971 100644
--- a/cc/x86_64_device.go
+++ b/cc/x86_64_device.go
@@ -36,7 +36,7 @@
 		"-fstrict-aliasing",
 		"-funswitch-loops",
 		"-funwind-tables",
-		"-fstack-protector",
+		"-fstack-protector-strong",
 		"-no-canonical-prefixes",
 		"-fno-canonical-system-headers",
 
diff --git a/cc/x86_darwin_host.go b/cc/x86_darwin_host.go
index e497e5c..1bd3dd0 100644
--- a/cc/x86_darwin_host.go
+++ b/cc/x86_darwin_host.go
@@ -65,6 +65,7 @@
 
 	darwinClangCflags = append([]string{
 		"-integrated-as",
+		"-fstack-protector-strong",
 	}, clangFilterUnknownCflags(darwinCflags)...)
 
 	darwinClangLdflags = clangFilterUnknownCflags(darwinLdflags)
diff --git a/cc/x86_device.go b/cc/x86_device.go
index e5a8f66..f3a4b08 100644
--- a/cc/x86_device.go
+++ b/cc/x86_device.go
@@ -36,7 +36,7 @@
 		"-fstrict-aliasing",
 		"-funswitch-loops",
 		"-funwind-tables",
-		"-fstack-protector",
+		"-fstack-protector-strong",
 		"-no-canonical-prefixes",
 		"-fno-canonical-system-headers",
 
diff --git a/cc/x86_linux_host.go b/cc/x86_linux_host.go
index 3bf9671..d1a92f1 100644
--- a/cc/x86_linux_host.go
+++ b/cc/x86_linux_host.go
@@ -69,6 +69,7 @@
 	linuxClangCflags = append([]string{
 		"--gcc-toolchain=${linuxGccRoot}",
 		"--sysroot=${linuxGccRoot}/sysroot",
+		"-fstack-protector-strong",
 	}, clangFilterUnknownCflags(linuxCflags)...)
 
 	linuxClangLdflags = append([]string{