diff --git a/arch/x86_64/src/cmake/Toolchain.cmake b/arch/x86_64/src/cmake/Toolchain.cmake
index c17f72eee0..e306fcbbbc 100644
--- a/arch/x86_64/src/cmake/Toolchain.cmake
+++ b/arch/x86_64/src/cmake/Toolchain.cmake
@@ -83,6 +83,10 @@ if(CONFIG_DEBUG_SYMBOLS)
   add_compile_options(${CONFIG_DEBUG_SYMBOLS_LEVEL})
 endif()
 
+if(CONFIG_HOST_LINUX)
+  add_link_options(-Wl,-z,noexecstack)
+endif()
+
 # Architecture flags
 
 add_link_options(-Wl,--entry=__pmode_entry)
diff --git a/arch/x86_64/src/common/Toolchain.defs b/arch/x86_64/src/common/Toolchain.defs
index 3687c6959c..27583e68bc 100644
--- a/arch/x86_64/src/common/Toolchain.defs
+++ b/arch/x86_64/src/common/Toolchain.defs
@@ -106,6 +106,10 @@ ifeq ($(CONFIG_DEBUG_LINK_WHOLE_ARCHIVE),y)
   LDFLAGS += --whole-archive
 endif
 
+ifeq ($(CONFIG_HOST_LINUX),y)
+  LDFLAGS += -z noexecstack
+endif
+
 ifeq ($(CONFIG_LIBCXX),y)
   # Linux C++ ABI seems vary.
   # Probably __GLIBCXX__ is the best bet.