diff --git a/debian/rules b/debian/rules
index 2d33f6a..fc17de4 100644
--- a/debian/rules
+++ b/debian/rules
@@ -1,4 +1,18 @@
 #!/usr/bin/make -f
 
+# Provides DEB_HOST_ARCH for arch-conditional compiler flags below.
+include /usr/share/dpkg/architecture.mk
+
+# +bindnow enables -Wl,-z,now (full RELRO); required by OpenSSF hardening baseline.
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all,+bindnow
+# OpenSSF Compiler Options Hardening Guide baseline.
+export DEB_CPPFLAGS_MAINT_APPEND = -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS
+# -ftrivial-auto-var-init=zero requires GCC >= 12; omit on older toolchains.
+GCC_MAJOR := $(shell gcc -dumpversion 2>/dev/null | cut -d. -f1)
+TRIVIAL_INIT := $(shell [ "$(GCC_MAJOR)" -ge 12 ] 2>/dev/null && echo "-ftrivial-auto-var-init=zero" || echo "")
+export DEB_CFLAGS_MAINT_APPEND   = -fstack-clash-protection $(if $(filter amd64,$(DEB_HOST_ARCH)),-fcf-protection=full) $(if $(filter arm64,$(DEB_HOST_ARCH)),-mbranch-protection=standard) -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing $(TRIVIAL_INIT)
+export DEB_CXXFLAGS_MAINT_APPEND = -fstack-clash-protection $(if $(filter amd64,$(DEB_HOST_ARCH)),-fcf-protection=full) $(if $(filter arm64,$(DEB_HOST_ARCH)),-mbranch-protection=standard) -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing $(TRIVIAL_INIT)
+export DEB_LDFLAGS_MAINT_APPEND  = -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,--as-needed
+
 %:
 	dh $@