diff --git a/cc/makevars.go b/cc/makevars.go
index 06b57c9..e4d8fe6 100644
--- a/cc/makevars.go
+++ b/cc/makevars.go
@@ -64,6 +64,9 @@
 	ctx.Strict("ADDRESS_SANITIZER_CONFIG_EXTRA_LDFLAGS", asanLdflags)
 	ctx.Strict("ADDRESS_SANITIZER_CONFIG_EXTRA_STATIC_LIBRARIES", asanLibs)
 
+	ctx.Strict("CFI_EXTRA_CFLAGS", cfiCflags)
+	ctx.Strict("CFI_EXTRA_LDFLAGS", cfiLdflags)
+
 	ctx.Strict("DEFAULT_C_STD_VERSION", config.CStdVersion)
 	ctx.Strict("DEFAULT_CPP_STD_VERSION", config.CppStdVersion)
 	ctx.Strict("DEFAULT_GCC_CPP_STD_VERSION", config.GccCppStdVersion)
diff --git a/cc/sanitize.go b/cc/sanitize.go
index 7eb191f..28c6ef5 100644
--- a/cc/sanitize.go
+++ b/cc/sanitize.go
@@ -28,6 +28,12 @@
 	asanCflags  = "-fno-omit-frame-pointer"
 	asanLdflags = "-Wl,-u,__asan_preinit"
 	asanLibs    = "libasan"
+
+	cfiCflags = "-flto -fsanitize-cfi-cross-dso -fvisibility=default " +
+		"-fsanitize-blacklist=external/compiler-rt/lib/cfi/cfi_blacklist.txt"
+	// FIXME: revert the __cfi_check flag when clang is updated to r280031.
+	cfiLdflags = "-flto -fsanitize-cfi-cross-dso -fsanitize=cfi " +
+		"-Wl,-plugin-opt,O1 -Wl,-export-dynamic-symbol=__cfi_check"
 )
 
 type sanitizerType int
@@ -324,12 +330,8 @@
 			flags.LdFlags = append(flags.LdFlags, "-march=armv7-a")
 		}
 		sanitizers = append(sanitizers, "cfi")
-		cfiFlags := []string{"-flto", "-fsanitize=cfi", "-fsanitize-cfi-cross-dso"}
-		flags.CFlags = append(flags.CFlags, cfiFlags...)
-		flags.CFlags = append(flags.CFlags, "-fvisibility=default")
-		flags.LdFlags = append(flags.LdFlags, cfiFlags...)
-		// FIXME: revert the __cfi_check flag when clang is updated to r280031.
-		flags.LdFlags = append(flags.LdFlags, "-Wl,-plugin-opt,O1", "-Wl,-export-dynamic-symbol=__cfi_check")
+		flags.CFlags = append(flags.CFlags, cfiCflags)
+		flags.LdFlags = append(flags.LdFlags, cfiLdflags)
 		if Bool(sanitize.Properties.Sanitize.Diag.Cfi) {
 			diagSanitizers = append(diagSanitizers, "cfi")
 		}