diff --git a/redhat-rpm-config.spec b/redhat-rpm-config.spec
index 7381c12..0f484ee 100644
--- a/redhat-rpm-config.spec
+++ b/redhat-rpm-config.spec
@@ -6,7 +6,7 @@
 
 Summary: Red Hat specific rpm configuration files
 Name: redhat-rpm-config
-Version: 172
+Version: 173
 Release: 1%{?dist}
 # No version specified.
 License: GPL+
@@ -213,6 +213,9 @@ install -p -m 644 -t %{buildroot}%{_rpmluadir}/fedora/srpm forge.lua
 %{_rpmconfigdir}/macros.d/macros.kmp
 
 %changelog
+* Fri Oct 30 2020 Florian Weimer <fweimer@redhat.com> - 173-1
+- x86_64: Re-add -fcf-protection to build flags (#1891308)
+
 * Fri Sep 11 2020 Miro Hrončok <mhroncok@redhat.com> - 172-1
 - Filter out LTO flags from %%extension flags macros
 - Fixes: rhbz#1877652
diff --git a/rpmrc b/rpmrc
index c0bad81..e2702b0 100644
--- a/rpmrc
+++ b/rpmrc
@@ -6,7 +6,7 @@ optflags: i586 %{__global_compiler_flags} -m32 -march=i586 -mtune=generic -fasyn
 optflags: i686 %{__global_compiler_flags} -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
 optflags: athlon %{__global_compiler_flags} -m32 -march=athlon -fasynchronous-unwind-tables -fstack-clash-protection
 optflags: ia64 %{__global_compiler_flags}
-optflags: x86_64 %{__global_compiler_flags} -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: x86_64 %{__global_compiler_flags} -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
 
 optflags: alpha %{__global_compiler_flags} -mieee
 optflags: alphaev5 %{__global_compiler_flags} -mieee -mcpu=ev5