diff --git a/Dockerfile.build b/Dockerfile.build
index d375b5f..90510df 100644
--- a/Dockerfile.build
+++ b/Dockerfile.build
@@ -1,5 +1,5 @@
 # explicitly use Debian for maximum cross-architecture compatibility
-FROM debian:bullseye-slim
+FROM debian:bookworm-slim
 
 RUN set -eux; \
 	apt-get update; \
@@ -36,7 +36,7 @@ RUN set -eux; \
 	rm -rf /var/lib/apt/lists/*
 
 # https://musl.libc.org/releases.html
-ENV MUSL_VERSION 1.2.4
+ENV MUSL_VERSION 1.2.5
 RUN set -eux; \
 	wget -O musl.tgz.asc "https://musl.libc.org/releases/musl-$MUSL_VERSION.tar.gz.asc"; \
 	wget -O musl.tgz "https://musl.libc.org/releases/musl-$MUSL_VERSION.tar.gz"; \
@@ -64,21 +64,21 @@ RUN set -ex; \
 	make clean all test \
 		TARGET_ARCH='arm32v5' \
 		CROSS_COMPILE='arm-linux-gnueabi-' \
-#		CFLAGS+='-march=armv5te' \
+#		EXTRA_CFLAGS='-march=armv5te' \
 		ARCH_TEST='armel'
 
 RUN set -ex; \
 	make clean all test \
 		TARGET_ARCH='arm32v6' \
 		CROSS_COMPILE='arm-linux-gnueabi-' \
-		CFLAGS+='-march=armv6+fp' \
+		EXTRA_CFLAGS='-march=armv6+fp' \
 		ARCH_TEST='armhf'
 
 RUN set -ex; \
 	make clean all test \
 		TARGET_ARCH='arm32v7' \
 		CROSS_COMPILE='arm-linux-gnueabihf-' \
-#		CFLAGS+='-march=armv7-a+fp' \
+#		EXTRA_CFLAGS='-march=armv7-a+fp' \
 		ARCH_TEST='armhf'
 
 RUN set -ex; \
@@ -103,7 +103,7 @@ RUN set -ex; \
 	make clean all test \
 		TARGET_ARCH='ppc64le' \
 		CROSS_COMPILE='powerpc64le-linux-gnu-' \
-		CFLAGS+='-mlong-double-64' \
+		EXTRA_CFLAGS='-mlong-double-64' \
 		ARCH_TEST='ppc64el'
 
 RUN set -ex; \
diff --git a/Makefile b/Makefile
index 9d25734..3bbc9f9 100644
--- a/Makefile
+++ b/Makefile
@@ -4,7 +4,8 @@ TARGET_ARCH := amd64
 export ARCH_TEST :=
 C_TARGETS := $(addsuffix hello, $(wildcard $(TARGET_ARCH)/*/))
 
-export CFLAGS := -Os -fdata-sections -ffunction-sections -s
+# norelro: https://stackoverflow.com/a/59084373/433558
+export CFLAGS := -Os -fdata-sections -ffunction-sections -Wl,-z,norelro -s $(EXTRA_CFLAGS)
 STRIP := $(CROSS_COMPILE)strip
 
 .PHONY: all
diff --git a/amd64/hello-world/hello b/amd64/hello-world/hello
index 4e91682..3ffc66f 100755
Binary files a/amd64/hello-world/hello and b/amd64/hello-world/hello differ
diff --git a/arm32v5/hello-world/hello b/arm32v5/hello-world/hello
index ec835f0..c9e599e 100755
Binary files a/arm32v5/hello-world/hello and b/arm32v5/hello-world/hello differ
diff --git a/arm32v6/hello-world/hello b/arm32v6/hello-world/hello
index 87174b5..a0336df 100755
Binary files a/arm32v6/hello-world/hello and b/arm32v6/hello-world/hello differ
diff --git a/arm32v7/hello-world/hello b/arm32v7/hello-world/hello
index d6fe736..dcf0633 100755
Binary files a/arm32v7/hello-world/hello and b/arm32v7/hello-world/hello differ
diff --git a/arm64v8/hello-world/hello b/arm64v8/hello-world/hello
index e409978..7d07099 100755
Binary files a/arm64v8/hello-world/hello and b/arm64v8/hello-world/hello differ
diff --git a/i386/hello-world/hello b/i386/hello-world/hello
index 9c2992e..d51e54c 100755
Binary files a/i386/hello-world/hello and b/i386/hello-world/hello differ
diff --git a/mips64le/hello-world/hello b/mips64le/hello-world/hello
index 7a71845..fff7035 100755
Binary files a/mips64le/hello-world/hello and b/mips64le/hello-world/hello differ
diff --git a/ppc64le/hello-world/hello b/ppc64le/hello-world/hello
index b88184f..22c63e0 100755
Binary files a/ppc64le/hello-world/hello and b/ppc64le/hello-world/hello differ
diff --git a/riscv64/hello-world/hello b/riscv64/hello-world/hello
index 357e879..af967ef 100755
Binary files a/riscv64/hello-world/hello and b/riscv64/hello-world/hello differ
diff --git a/s390x/hello-world/hello b/s390x/hello-world/hello
index 69add68..986d234 100755
Binary files a/s390x/hello-world/hello and b/s390x/hello-world/hello differ