diff --git a/build-compiler-rt.sh b/build-compiler-rt.sh
index 1fff641..4a7549a 100755
--- a/build-compiler-rt.sh
+++ b/build-compiler-rt.sh
@@ -19,8 +19,8 @@ set -e
 SRC_DIR=../lib/builtins
 BUILD_SUFFIX=
 BUILD_BUILTINS=TRUE
-ENABLE_CFGUARD=
-CFGUARD_CFLAGS=
+ENABLE_CFGUARD=1
+CFGUARD_CFLAGS="-mguard=cf"
 
 while [ $# -gt 0 ]; do
     if [ "$1" = "--build-sanitizers" ]; then
@@ -28,6 +28,12 @@ while [ $# -gt 0 ]; do
         BUILD_SUFFIX=-sanitizers
         SANITIZERS=1
         BUILD_BUILTINS=FALSE
+        # Override the default cfguard options here; this unfortunately
+        # also overrides the user option if --enable-cfguard is passed
+        # before --build-sanitizers (although that combination isn't
+        # really intended/supported anyway).
+        CFGUARD_CFLAGS=
+        ENABLE_CFGUARD=
     elif [ "$1" = "--enable-cfguard" ]; then
         CFGUARD_CFLAGS="-mguard=cf"
         ENABLE_CFGUARD=1
diff --git a/build-libcxx.sh b/build-libcxx.sh
index be0a8bc..7381ab6 100755
--- a/build-libcxx.sh
+++ b/build-libcxx.sh
@@ -18,7 +18,7 @@ set -e
 
 BUILD_STATIC=ON
 BUILD_SHARED=ON
-CFGUARD_CFLAGS=
+CFGUARD_CFLAGS="-mguard=cf"
 
 while [ $# -gt 0 ]; do
     if [ "$1" = "--disable-shared" ]; then
diff --git a/build-libssp.sh b/build-libssp.sh
index 6b4b064..f8b218c 100755
--- a/build-libssp.sh
+++ b/build-libssp.sh
@@ -16,7 +16,7 @@
 
 set -e
 
-CFGUARD_CFLAGS=
+CFGUARD_CFLAGS="-mguard=cf"
 
 while [ $# -gt 0 ]; do
     case "$1" in
diff --git a/build-mingw-w64-libraries.sh b/build-mingw-w64-libraries.sh
index 3836ad1..7549be4 100755
--- a/build-mingw-w64-libraries.sh
+++ b/build-mingw-w64-libraries.sh
@@ -16,7 +16,7 @@
 
 set -e
 
-USE_CFLAGS="-g -O2"
+USE_CFLAGS="-g -O2 -mguard=cf"
 
 while [ $# -gt 0 ]; do
     case "$1" in
diff --git a/build-mingw-w64.sh b/build-mingw-w64.sh
index 3eafbe1..8a7e83e 100755
--- a/build-mingw-w64.sh
+++ b/build-mingw-w64.sh
@@ -20,7 +20,7 @@ set -e
 : ${DEFAULT_MSVCRT:=ucrt}
 : ${MINGW_W64_VERSION:=ce5a9f624dfc691082dad2ea2af7b1985e3476b5}
 
-CFGUARD_FLAGS=
+CFGUARD_FLAGS="--enable-cfguard"
 
 while [ $# -gt 0 ]; do
     case "$1" in
diff --git a/build-openmp.sh b/build-openmp.sh
index ee6f1a5..26fabcd 100755
--- a/build-openmp.sh
+++ b/build-openmp.sh
@@ -16,7 +16,7 @@
 
 set -e
 
-CFGUARD_CFLAGS=
+CFGUARD_CFLAGS="-mguard=cf"
 
 while [ $# -gt 0 ]; do
     case "$1" in