diff --git a/grub.macros b/grub.macros
index 061c778..77be76d 100644
--- a/grub.macros
+++ b/grub.macros
@@ -15,7 +15,12 @@
 %endif
 
 # gnulib actively ignores CFLAGS because it's terrible
+# build aarch64 gnulib with branch protection
+%ifarch aarch64
+%global cc_equals "CC=%{ccpath} -fPIE -Wl,-z,noexecstack -Wl,--no-warn-rwx-segments -mbranch-protection=standard"
+%else
 %global cc_equals "CC=%{ccpath} -fPIE -Wl,-z,noexecstack -Wl,--no-warn-rwx-segments"
+%endif
 
 %global cflags_sed						\\\
 	sed							\\\
diff --git a/grub2.spec b/grub2.spec
index 67de4f5..0739c21 100644
--- a/grub2.spec
+++ b/grub2.spec
@@ -17,7 +17,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.12
-Release:	6%{?dist}
+Release:	7%{?dist}
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPL-3.0-or-later
 URL:		http://www.gnu.org/software/grub/
@@ -562,6 +562,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg
 %endif
 
 %changelog
+* Tue Sep 17 2024 Nicolas Frayer <nfrayer@redhat.com> - 2.12-7
+- aarch64/macros: Build gnulib with -mbranch-protection=standard
+
 * Thu Sep 5 2024 Leo Sandoval <lsandova@redhat.com> - 2.12-6
 - load EFI commands inside test expressions
 - Resolves: #2305291