diff --git a/grub.macros b/grub.macros
index 344f5b2..e88a289 100644
--- a/grub.macros
+++ b/grub.macros
@@ -15,7 +15,7 @@
 %endif
 
 # gnulib actively ignores CFLAGS because it's terrible
-%global cc_equals "CC=%{ccpath} -fPIE"
+%global cc_equals "CC=%{ccpath} -fPIE -Wl,-z,noexecstack"
 
 %global cflags_sed						\\\
 	sed							\\\
diff --git a/grub2.spec b/grub2.spec
index 1367fe6..697cbee 100644
--- a/grub2.spec
+++ b/grub2.spec
@@ -17,7 +17,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.06
-Release:	85%{?dist}
+Release:	86%{?dist}
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPLv3+
 URL:		http://www.gnu.org/software/grub/
@@ -544,6 +544,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
 %endif
 
 %changelog
+* Fri Feb 10 2023 Robbie Harwood <rharwood@redhat.com> - 2.06-86
+- Override the linker and force nonexecutable stacks
+
 * Wed Feb 08 2023 Robbie Harwood <rharwood@redhat.com> - 2.06-85
 - ppc64le: sync cas/tpm patchset with upstream