diff --git a/ghostscript-mini.changes b/ghostscript-mini.changes
index a9160a4..c4b6b7e 100644
--- a/ghostscript-mini.changes
+++ b/ghostscript-mini.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Wed Apr 14 11:57:25 UTC 2021 - Wolfgang Frisch <wolfgang.frisch@suse.com>
+
+- Hardening: compile with PIC, link as PIE
+
 -------------------------------------------------------------------
 Fri Mar 26 13:42:05 UTC 2021 - Dominique Leuenberger <dimstar@opensuse.org>
 
diff --git a/ghostscript-mini.spec b/ghostscript-mini.spec
index 00bf008..7928ebd 100644
--- a/ghostscript-mini.spec
+++ b/ghostscript-mini.spec
@@ -215,8 +215,9 @@ rm -rf lcms2art
 # Derive build timestamp from latest changelog entry
 export SOURCE_DATE_EPOCH=$(date -d "$(head -n 2 %{_sourcedir}/%{name}.changes | tail -n 1 | cut -d- -f1 )" +%s)
 # Set our preferred architecture-specific flags for the compiler and linker:
-export CFLAGS="%{optflags} -fno-strict-aliasing"
-export CXXFLAGS="%{optflags} -fno-strict-aliasing"
+export CFLAGS="%{optflags} -fno-strict-aliasing -fPIC"
+export CXXFLAGS="%{optflags} -fno-strict-aliasing -fPIC"
+export LDFLAGS="-pie"
 autoreconf -fi
 # --docdir=%%{_defaultdocdir}/%%{name} does not work therefore it is not used.
 # --disable-cups and --without-pdftoraster
diff --git a/ghostscript.changes b/ghostscript.changes
index e046931..97ba642 100644
--- a/ghostscript.changes
+++ b/ghostscript.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Wed Apr 14 11:56:22 UTC 2021 - Wolfgang Frisch <wolfgang.frisch@suse.com>
+
+- Hardening: compile with PIC, link as PIE
+
 -------------------------------------------------------------------
 Tue Oct 20 16:38:24 CEST 2020 - Ismail Dönmez <idonmez@suse.com>
 
diff --git a/ghostscript.spec b/ghostscript.spec
index 85f325f..09ce87c 100644
--- a/ghostscript.spec
+++ b/ghostscript.spec
@@ -356,8 +356,9 @@ rm -rf lcms2art
 # Derive build timestamp from latest changelog entry
 export SOURCE_DATE_EPOCH=$(date -d "$(head -n 2 %{_sourcedir}/%{name}.changes | tail -n 1 | cut -d- -f1 )" +%s)
 # Set our preferred architecture-specific flags for the compiler and linker:
-export CFLAGS="%{optflags} -fno-strict-aliasing"
-export CXXFLAGS="%{optflags} -fno-strict-aliasing"
+export CFLAGS="%{optflags} -fno-strict-aliasing -fPIC"
+export CXXFLAGS="%{optflags} -fno-strict-aliasing -fPIC"
+export LDFLAGS="-pie"
 autoreconf -fi
 # --docdir=%%{_defaultdocdir}/%%{name} does not work therefore it is not used.
 # --enable-cups but no longer --with-pdftoraster --enable-dbus --with-install-cups because