diff --git a/CMakeLists.txt b/CMakeLists.txt
index cab853581..346b2592e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -572,6 +572,9 @@ else()
   add_c_flag_if_supported(-fstack-protector-strong C_SECURITY_FLAGS)
   add_cxx_flag_if_supported(-fstack-protector-strong CXX_SECURITY_FLAGS)
 
+  add_c_flag_if_supported(-mmitigate-rop C_SECURITY_FLAGS)
+  add_cxx_flag_if_supported(-mmitigate-rop CXX_SECURITY_FLAGS)
+
   # linker
   if (NOT WIN32)
     # Windows binaries die on startup with PIE