diff --git a/CMakeLists.txt b/CMakeLists.txt
index e4b6bfe01..84e52d41a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -578,6 +578,9 @@ else()
     add_cxx_flag_if_supported(-fstack-clash-protection CXX_SECURITY_FLAGS)
   endif()
 
+  add_c_flag_if_supported(-mmitigate-rop C_SECURITY_FLAGS)
+  add_cxx_flag_if_supported(-mmitigate-rop CXX_SECURITY_FLAGS)
+
   # linker
   if (NOT WIN32)
     # Windows binaries die on startup with PIE