diff --git a/.github/workflows/build-all-and-publish.yml b/.github/workflows/build-all-and-publish.yml
index 815d7a3..59a69bf 100644
--- a/.github/workflows/build-all-and-publish.yml
+++ b/.github/workflows/build-all-and-publish.yml
@@ -16,33 +16,36 @@ jobs:
   linux:
     name: Linux natives (${{ matrix.arch }})
     runs-on: ubuntu-latest
+    env:
+      NATIVE_BASE_CFLAGS: -O2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection
+      NATIVE_XXHASH_EXTRA_CFLAGS: -fno-tree-vectorize
     strategy:
       fail-fast: false
       matrix:
         include:
           - arch: amd64
             cc: gcc
-            cflags: ""
+            arch_cflags: ""
             ldflags: ""
             apt: ""
           - arch: i386
             cc: gcc
-            cflags: "-m32"
+            arch_cflags: "-m32"
             ldflags: ""
             apt: "gcc-multilib libc6-dev-i386"
           - arch: aarch64
             cc: aarch64-linux-gnu-gcc
-            cflags: ""
+            arch_cflags: ""
             ldflags: ""
             apt: "gcc-aarch64-linux-gnu"
           - arch: ppc64le
             cc: powerpc64le-linux-gnu-gcc
-            cflags: ""
+            arch_cflags: ""
             ldflags: ""
             apt: "gcc-powerpc64le-linux-gnu"
           - arch: s390x
             cc: s390x-linux-gnu-gcc
-            cflags: ""
+            arch_cflags: ""
             ldflags: ""
             apt: "gcc-s390x-linux-gnu"
 
@@ -73,12 +76,13 @@ jobs:
 
       - name: Build (mvn package)
         run: |
-          ./mvnw -B -V -DskipTests \
-            -Darch.id=${{ matrix.arch }} \
-            -Dnative.cc=${{ matrix.cc }} \
-            "-Dnative.cflags=${{ matrix.cflags }}" \
-            "-Dnative.ldflags=${{ matrix.ldflags }}" \
-            package
+            ./mvnw -B -V -DskipTests \
+              -Darch.id=${{ matrix.arch }} \
+              -Dnative.cc=${{ matrix.cc }} \
+              "-Dnative.cflags=${{ env.NATIVE_BASE_CFLAGS }} ${{ matrix.arch_cflags }}" \
+              "-Dnative.xxhash.cflags=${{ env.NATIVE_BASE_CFLAGS }} ${{ matrix.arch_cflags }} ${{ env.NATIVE_XXHASH_EXTRA_CFLAGS }}" \
+              "-Dnative.ldflags=${{ matrix.ldflags }}" \
+              package
 
       - name: Upload native library
         uses: actions/upload-artifact@v4
diff --git a/pom.xml b/pom.xml
index 8f4525a..466dd71 100644
--- a/pom.xml
+++ b/pom.xml
@@ -388,6 +388,10 @@
           <name>Linux</name>
         </os>
       </activation>
+      <properties>
+        <native.cflags>-O2 -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection</native.cflags>
+        <native.xxhash.cflags>${native.cflags} -fno-tree-vectorize</native.xxhash.cflags>
+      </properties>
       <build>
         <plugins>
           <plugin>
@@ -417,20 +421,75 @@
                     <!-- Toolchain overrides come from Maven properties: ${native.cc}, ${native.cflags}, ${native.ldflags} -->
 
                     <mkdir dir="${project.build.outputDirectory}/net/jpountz/util/${os.id}/${arch.id}"/>
+                    <mkdir dir="${project.build.directory}/native/${os.id}/${arch.id}"/>
                     <exec executable="${native.cc}" failonerror="true">
                       <env key="SOURCE_DATE_EPOCH" value="0"/>
-                      <arg value="-O3"/>
-                      <arg value="-fPIC"/>
-                      <arg value="-shared"/>
                       <arg line="${native.cflags}"/>
+                      <arg value="-fPIC"/>
                       <arg value="-I${project.basedir}/src/lz4/lib"/>
                       <arg value="-I${java.home}/include"/>
                       <arg value="-I${java.home}/include/linux"/>
+                      <arg value="-c"/>
                       <arg value="${project.basedir}/src/jni/net_jpountz_lz4_LZ4JNI.c"/>
+                      <arg value="-o"/>
+                      <arg value="${project.build.directory}/native/${os.id}/${arch.id}/net_jpountz_lz4_LZ4JNI.o"/>
+                    </exec>
+                    <exec executable="${native.cc}" failonerror="true">
+                      <env key="SOURCE_DATE_EPOCH" value="0"/>
+                      <arg line="${native.cflags}"/>
+                      <arg value="-fPIC"/>
+                      <arg value="-I${project.basedir}/src/lz4/lib"/>
+                      <arg value="-I${java.home}/include"/>
+                      <arg value="-I${java.home}/include/linux"/>
+                      <arg value="-c"/>
                       <arg value="${project.basedir}/src/jni/net_jpountz_xxhash_XXHashJNI.c"/>
+                      <arg value="-o"/>
+                      <arg value="${project.build.directory}/native/${os.id}/${arch.id}/net_jpountz_xxhash_XXHashJNI.o"/>
+                    </exec>
+                    <exec executable="${native.cc}" failonerror="true">
+                      <env key="SOURCE_DATE_EPOCH" value="0"/>
+                      <arg line="${native.cflags}"/>
+                      <arg value="-fPIC"/>
+                      <arg value="-I${project.basedir}/src/lz4/lib"/>
+                      <arg value="-I${java.home}/include"/>
+                      <arg value="-I${java.home}/include/linux"/>
+                      <arg value="-c"/>
                       <arg value="${project.basedir}/src/lz4/lib/lz4.c"/>
+                      <arg value="-o"/>
+                      <arg value="${project.build.directory}/native/${os.id}/${arch.id}/lz4.o"/>
+                    </exec>
+                    <exec executable="${native.cc}" failonerror="true">
+                      <env key="SOURCE_DATE_EPOCH" value="0"/>
+                      <arg line="${native.cflags}"/>
+                      <arg value="-fPIC"/>
+                      <arg value="-I${project.basedir}/src/lz4/lib"/>
+                      <arg value="-I${java.home}/include"/>
+                      <arg value="-I${java.home}/include/linux"/>
+                      <arg value="-c"/>
                       <arg value="${project.basedir}/src/lz4/lib/lz4hc.c"/>
+                      <arg value="-o"/>
+                      <arg value="${project.build.directory}/native/${os.id}/${arch.id}/lz4hc.o"/>
+                    </exec>
+                    <exec executable="${native.cc}" failonerror="true">
+                      <env key="SOURCE_DATE_EPOCH" value="0"/>
+                      <arg line="${native.xxhash.cflags}"/>
+                      <arg value="-fPIC"/>
+                      <arg value="-I${project.basedir}/src/lz4/lib"/>
+                      <arg value="-I${java.home}/include"/>
+                      <arg value="-I${java.home}/include/linux"/>
+                      <arg value="-c"/>
                       <arg value="${project.basedir}/src/lz4/lib/xxhash.c"/>
+                      <arg value="-o"/>
+                      <arg value="${project.build.directory}/native/${os.id}/${arch.id}/xxhash.o"/>
+                    </exec>
+                    <exec executable="${native.cc}" failonerror="true">
+                      <env key="SOURCE_DATE_EPOCH" value="0"/>
+                      <arg value="-shared"/>
+                      <arg value="${project.build.directory}/native/${os.id}/${arch.id}/net_jpountz_lz4_LZ4JNI.o"/>
+                      <arg value="${project.build.directory}/native/${os.id}/${arch.id}/net_jpountz_xxhash_XXHashJNI.o"/>
+                      <arg value="${project.build.directory}/native/${os.id}/${arch.id}/lz4.o"/>
+                      <arg value="${project.build.directory}/native/${os.id}/${arch.id}/lz4hc.o"/>
+                      <arg value="${project.build.directory}/native/${os.id}/${arch.id}/xxhash.o"/>
                       <arg line="${native.ldflags}"/>
                       <arg value="-o"/>
                       <arg value="${project.build.outputDirectory}/net/jpountz/util/${os.id}/${arch.id}/liblz4-java.${lib.ext}"/>