diff --git a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
index fb85580360..8eebd62b04 100755
--- a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
@@ -20,12 +20,12 @@ mount --mkdir --rbind "$PWD/pkg/$ID" "pkg/$ID/src/"
 # shellcheck source=/dev/null
 . /etc/makepkg.conf
 
-# Override the default options. Use -Og because -O0 doesn't work with FORTIFY_SOURCE. We specifically disable
-# "strip", "zipman" and "lto" as they slow down builds significantly. OPTIONS= cannot be overridden on the
-# makepkg command line so we append to /etc/makepkg.conf instead. The rootfs is overlaid with a writable
-# tmpfs during the build script so these changes don't end up in the image itself.
+# Override the default options. Disable FORTIFY_SOURCE because it doesn't work with O0. We specifically
+# disable "strip", "zipman" and "lto" as they slow down builds significantly. OPTIONS= cannot be overridden
+# on the makepkg command line so we append to /etc/makepkg.conf instead. The rootfs is overlaid with a
+# writable tmpfs during the build script so these changes don't end up in the image itself.
 tee --append /etc/makepkg.conf >/dev/null <<EOF
-CFLAGS="$CFLAGS -Og"
+CFLAGS="$CFLAGS -O0 -Wp,-D_FORTIFY_SOURCE=0"
 OPTIONS=(
     docs
     !libtool
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
index 81613f3954..0cba71bf7a 100755
--- a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
@@ -31,7 +31,8 @@ DIST="$(rpm --eval %dist)"
 ARCH="$(rpm --eval %_arch)"
 SRCDEST="/usr/src/debug/systemd-$VERSION-${RELEASE}${DIST}.$ARCH"
 
-EXTRA_CFLAGS="-Og"
+# TODO: Drop -D_FORTIFY_SOURCE when we switch to CentOS Stream 10.
+EXTRA_CFLAGS="-O0 -Wp,-D_FORTIFY_SOURCE=0"
 if ((WITH_DEBUG)); then
     EXTRA_CFLAGS="$EXTRA_CFLAGS -ffile-prefix-map=../src=$SRCDEST"
 fi
@@ -71,6 +72,7 @@ rpmbuild \
     --define "__elf_exclude_path ^/usr/lib/systemd/tests/unit-tests/.*$" \
     --define "__script_requires %{nil}" \
     --define "_find_debuginfo_dwz_opts %{nil}" \
+    --define "_fortify_level 0" \
     --undefine _lto_cflags \
     --noclean \
     "pkg/$ID/systemd.spec"
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
index 3a89e49c5b..a8775d05f1 100755
--- a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
@@ -46,15 +46,15 @@ build() {
         $( ((WITH_TESTS)) || echo nocheck) \
         $( ((WITH_DOCS)) || echo nodoc) \
         $( ((WITH_DEBUG)) || echo nostrip) \
-        terse
+        terse \
         optimize=-lto \
+        noopt \
     " \
     DEB_BUILD_PROFILES="\
         $( ((WITH_TESTS)) || echo nocheck) \
         $( ((WITH_DOCS)) || echo nodoc) \
         pkg.systemd.upstream \
     " \
-    DEB_CFLAGS_APPEND="-Og" \
     DPKG_FORCE="unsafe-io" \
     DPKG_DEB_COMPRESSOR_TYPE="none" \
     DH_MISSING="--fail-missing" \