diff --git a/CMakeLists.txt b/CMakeLists.txt
index a02f62e62..e4b6bfe01 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -570,6 +570,14 @@ else()
     add_cxx_flag_if_supported(-fstack-protector-strong CXX_SECURITY_FLAGS)
   endif()
 
+  # New in GCC 8.2
+  if (NOT WIN32)
+    add_c_flag_if_supported(-fcf-protection=full C_SECURITY_FLAGS)
+    add_cxx_flag_if_supported(-fcf-protection=full CXX_SECURITY_FLAGS)
+    add_c_flag_if_supported(-fstack-clash-protection C_SECURITY_FLAGS)
+    add_cxx_flag_if_supported(-fstack-clash-protection CXX_SECURITY_FLAGS)
+  endif()
+
   # linker
   if (NOT WIN32)
     # Windows binaries die on startup with PIE