diff --git a/redhat-rpm-config.spec b/redhat-rpm-config.spec
index 777c547..52f2de9 100644
--- a/redhat-rpm-config.spec
+++ b/redhat-rpm-config.spec
@@ -6,7 +6,7 @@
 
 Summary: Red Hat specific rpm configuration files
 Name: redhat-rpm-config
-Version: 75
+Version: 76
 Release: 1%{?dist}
 # No version specified.
 License: GPL+
@@ -153,6 +153,9 @@ install -p -m 755 -t %{buildroot}%{_rpmconfigdir} kmod.prov
 %{_rpmconfigdir}/macros.d/macros.kmp
 
 %changelog
+* Wed Jan 17 2018 Florian Weimer <fweimer@redhat.com> - 76-1
+- Add -fstack-clash-protection for supported architectures (#1515865)
+
 * Wed Jan 17 2018 Florian Weimer <fweimer@redhat.com> - 75-1
 - Add _GLIBCXX_ASSERTIONS to CFLAGS/CXXFLAGS (#1515858)
 
diff --git a/rpmrc b/rpmrc
index c7336d6..ada27fb 100644
--- a/rpmrc
+++ b/rpmrc
@@ -1,12 +1,12 @@
 include: /usr/lib/rpm/rpmrc
 
-optflags: i386 %{__global_compiler_flags} -m32 -march=i386 -mtune=generic -fasynchronous-unwind-tables
-optflags: i486 %{__global_compiler_flags} -m32 -march=i486 -fasynchronous-unwind-tables
-optflags: i586 %{__global_compiler_flags} -m32 -march=i586 -mtune=generic -fasynchronous-unwind-tables
-optflags: i686 %{__global_compiler_flags} -m32 -march=i686 -fasynchronous-unwind-tables
-optflags: athlon %{__global_compiler_flags} -m32 -march=athlon -fasynchronous-unwind-tables
+optflags: i386 %{__global_compiler_flags} -m32 -march=i386 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: i486 %{__global_compiler_flags} -m32 -march=i486 -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: i586 %{__global_compiler_flags} -m32 -march=i586 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: i686 %{__global_compiler_flags} -m32 -march=i686 -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: athlon %{__global_compiler_flags} -m32 -march=athlon -fasynchronous-unwind-tables -fstack-clash-protection
 optflags: ia64 %{__global_compiler_flags}
-optflags: x86_64 %{__global_compiler_flags} -m64 -mtune=generic
+optflags: x86_64 %{__global_compiler_flags} -m64 -mtune=generic -fstack-clash-protection
 
 optflags: alpha %{__global_compiler_flags} -mieee
 optflags: alphaev5 %{__global_compiler_flags} -mieee -mcpu=ev5
@@ -27,9 +27,9 @@ optflags: m68k %{__global_compiler_flags}
 optflags: ppc %{__global_compiler_flags} -m32
 optflags: ppciseries %{__global_compiler_flags} -m32
 optflags: ppcpseries %{__global_compiler_flags} -m32
-optflags: ppc64 %{__global_compiler_flags} -m64
-optflags: ppc64p7 %{__global_compiler_flags} -m64 -O3 -mcpu=power7 -mtune=power7
-optflags: ppc64le %{__global_compiler_flags} -m64 -mcpu=power8 -mtune=power8
+optflags: ppc64 %{__global_compiler_flags} -m64 -fstack-clash-protection
+optflags: ppc64p7 %{__global_compiler_flags} -m64 -O3 -mcpu=power7 -mtune=power7 -fstack-clash-protection
+optflags: ppc64le %{__global_compiler_flags} -m64 -mcpu=power8 -mtune=power8 -fstack-clash-protection
 optflags: ppc64iseries %{__global_compiler_flags} -m64
 optflags: ppc64pseries %{__global_compiler_flags} -m64
 optflags: ppc8260 %{__global_compiler_flags} -m32
@@ -72,9 +72,9 @@ optflags: milan %{__global_compiler_flags}
 optflags: hades %{__global_compiler_flags}
 
 optflags: s390 %{__global_compiler_flags} -m31 -march=zEC12 -mtune=z13
-optflags: s390x %{__global_compiler_flags} -m64 -march=zEC12 -mtune=z13
+optflags: s390x %{__global_compiler_flags} -m64 -march=zEC12 -mtune=z13 -fstack-clash-protection
 
-optflags: aarch64 %{__global_compiler_flags}
+optflags: aarch64 %{__global_compiler_flags} -fstack-clash-protection
 
 optflags: riscv64 %{__global_compiler_flags}