diff --git a/buildflags.md b/buildflags.md
index b279bbb..db0e7db 100644
--- a/buildflags.md
+++ b/buildflags.md
@@ -276,10 +276,16 @@ tuning in the `gcc` package.  These settings are:
     with other ARMv7-A implementations).  `-mabi=aapcs-linux` switches to
     the AAPCS ABI for GNU/Linux.
 *   **i686**: `-march=i686` is used to select a minmum support CPU level
-    of i686 (corresponding to the Pentium Pro).  `-mtune=generic` activates
-    tuning for a current blend of CPUs (under the assumption that most
-    users of i686 packages obtain them through an x86_64 installation
-    on current hardware).
+    of i686 (corresponding to the Pentium Pro).  SSE2 support is
+    enabled with `-msse2` (so only CPUs with SSE2 support can run the
+    compiled code; SSE2 was introduced first with the Pentium 4).
+    `-mtune=generic` activates tuning for a current blend of CPUs
+    (under the assumption that most users of i686 packages obtain them
+    through an x86_64 installation on current hardware).
+    `-mfpmath=sse` instructs GCC to use the SSE2 unit for floating
+    point math to avoid excess precision issues.  `-mstackrealign`
+    avoids relying on the stack alignment guaranteed by the current
+    version of the i386 ABI.
 *   **ppc64le**: `-mcpu=power8 -mtune=power8` selects a minimum supported
     CPU level of POWER8 (the first CPU with ppc64le support) and tunes
     for POWER8.
diff --git a/redhat-rpm-config.spec b/redhat-rpm-config.spec
index f5c614d..f18eecd 100644
--- a/redhat-rpm-config.spec
+++ b/redhat-rpm-config.spec
@@ -6,7 +6,7 @@
 
 Summary: Red Hat specific rpm configuration files
 Name: redhat-rpm-config
-Version: 112
+Version: 113
 Release: 1%{?dist}
 # No version specified.
 License: GPL+
@@ -184,6 +184,9 @@ install -p -m 755 -t %{buildroot}%{_rpmconfigdir} kmod.prov
 %{_rpmconfigdir}/macros.d/macros.kmp
 
 %changelog
+* Mon Jun 18 2018 Florian Weimer <fweimer@redhat.com> - 113-1
+- Build flags: Require SSE2 on i686 (#1592212)
+
 * Mon May 28 2018 Miro Hrončok <mhroncok@redhat.com> - 112-1
 - Add a possibility to opt-out form automagic Python bytecompilation
   https://fedoraproject.org/wiki/Changes/No_more_automagic_Python_bytecompilation
diff --git a/rpmrc b/rpmrc
index 015004a..630c8c0 100644
--- a/rpmrc
+++ b/rpmrc
@@ -3,7 +3,7 @@ include: /usr/lib/rpm/rpmrc
 optflags: i386 %{__global_compiler_flags} -m32 -march=i386 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection
 optflags: i486 %{__global_compiler_flags} -m32 -march=i486 -fasynchronous-unwind-tables -fstack-clash-protection
 optflags: i586 %{__global_compiler_flags} -m32 -march=i586 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection
-optflags: i686 %{__global_compiler_flags} -m32 -march=i686 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
+optflags: i686 %{__global_compiler_flags} -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
 optflags: athlon %{__global_compiler_flags} -m32 -march=athlon -fasynchronous-unwind-tables -fstack-clash-protection
 optflags: ia64 %{__global_compiler_flags}
 optflags: x86_64 %{__global_compiler_flags} -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection