diff --git a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
index 13d4ebeb18..5abeea5493 100755
--- a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
@@ -1,6 +1,6 @@
 #!/bin/bash
 # SPDX-License-Identifier: LGPL-2.1-or-later
-set -ex
+set -e
 
 # shellcheck source=/dev/null
 . /usr/lib/os-release
@@ -25,7 +25,7 @@ mount --mkdir --rbind "$PWD/pkg/$ID" "pkg/$ID/src/"
 # on the makepkg command line so we append to /etc/makepkg.conf instead. The rootfs is overlaid with a
 # writable tmpfs during the build script so these changes don't end up in the image itself.
 tee --append /etc/makepkg.conf >/dev/null <<EOF
-CFLAGS="$CFLAGS -O0 -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=0"
+CFLAGS="$CFLAGS -O0 -Wp,-U_FORTIFY_SOURCE"
 OPTIONS=(
     docs
     !libtool
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
index 46a509b330..f745a2c002 100755
--- a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
@@ -31,8 +31,8 @@ DIST="$(rpm --eval %dist)"
 ARCH="$(rpm --eval %_arch)"
 SRCDEST="/usr/src/debug/systemd-$VERSION-${RELEASE}${DIST}.$ARCH"
 
-# TODO: Drop -D_FORTIFY_SOURCE when we switch to CentOS Stream 10.
-EXTRA_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=0"
+# TODO: Drop -U_FORTIFY_SOURCE when we switch to CentOS Stream 10.
+EXTRA_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE"
 if ((WITH_DEBUG)); then
     EXTRA_CFLAGS="$EXTRA_CFLAGS -ffile-prefix-map=../src=$SRCDEST"
 fi
diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot
index 6261be1990..be27099791 100755
--- a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot
@@ -37,7 +37,7 @@ ARCH="$(rpm --eval %_arch)"
 SRCDEST="/usr/src/debug/systemd-$VERSION-${RELEASE}${DIST}.$ARCH"
 
 # TODO: Enable this when the opensuse spec stops unconditionally setting FORTIFY_SOURCE=2.
-# EXTRA_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=0"
+# EXTRA_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE"
 EXTRA_CFLAGS=""
 if ((WITH_DEBUG)); then
     EXTRA_CFLAGS="$EXTRA_CFLAGS -ffile-prefix-map=../src=$SRCDEST"