diff --git a/Makefile.am b/Makefile.am
index 8b52f854..fed3a17e 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2,7 +2,7 @@ SUFFIXES= .rst
 
 EXTRA_DIST = COPYING scripts/findstatic.pl swupd.bash swupd.zsh config
 
-AM_CFLAGS = -fPIE -fPIC -g -D_FORTIFY_SOURCE=2 -fno-common -std=gnu99 \
+AM_CFLAGS = -fPIE -fPIC -g -fno-common -std=gnu99 \
 	-O$(OPTIMIZE) \
 	-Wall \
 	-Wextra \
@@ -22,6 +22,10 @@ AM_CFLAGS = -fPIE -fPIC -g -D_FORTIFY_SOURCE=2 -fno-common -std=gnu99 \
 	-fno-delete-null-pointer-checks \
 	-fwrapv
 
+if ENABLE_FORTIFY
+AM_CFLAGS += -D_FORTIFY_SOURCE=2
+endif
+
 AM_LDFLAGS = -z noexecstack -z relro -z now \
 	-pie
 
diff --git a/configure.ac b/configure.ac
index a6dbdad3..f4ff9943 100644
--- a/configure.ac
+++ b/configure.ac
@@ -41,6 +41,7 @@ AS_IF(
   [AC_SUBST(OPTIMIZE, [0])],
   [AC_SUBST(OPTIMIZE, [2])]
 )
+AM_CONDITIONAL([ENABLE_FORTIFY], [test "$enable_optimizations" != "no"])
 
 AC_ARG_ENABLE(
   [bzip2],
diff --git a/scripts/build_and_run_tests.bash b/scripts/build_and_run_tests.bash
index 2c2f89e1..4a2b9307 100755
--- a/scripts/build_and_run_tests.bash
+++ b/scripts/build_and_run_tests.bash
@@ -30,7 +30,7 @@ run_checks() {
 }
 
 # Run tests without any security optimization and with address sanitizer
-CFLAGS="-fsanitize=address -fno-omit-frame-pointer" run_build --disable-optimizations "$CONFIGURE_ARGS"
+CFLAGS="-fsanitize=address -fno-omit-frame-pointer -Werror" run_build --disable-optimizations "$CONFIGURE_ARGS"
 run_checks
 
 # Run build with basic configurations