diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40.ebuild
index 95fe278997..0d5192d356 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40.ebuild
@@ -171,7 +171,7 @@ src_configure() {
 
 	# Keep things sane
 	strip-flags
-
+	use cet && filter-flags -mindirect-branch -mindirect-branch=*
 	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
 
 	local x
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
index eae71c276c..c8e0d5f949 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
@@ -171,6 +171,8 @@ src_configure() {
 
 	# Keep things sane
 	strip-flags
+	use cet && filter-flags -mindirect-branch -mindirect-branch=*
+	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
 
 	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
 	# https://github.com/gentoo/gentoo/pull/28355