diff --git a/tboot.changes b/tboot.changes
index a00a967..76a6388 100644
--- a/tboot.changes
+++ b/tboot.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Jul 11 08:06:42 UTC 2019 - mgerstner <matthias.gerstner@suse.com>
+
+- explicitly disable gcc9 link time optimization to fix the build and avoid
+  trouble in low level tboot code.
+
 -------------------------------------------------------------------
 Tue May 28 08:19:14 UTC 2019 - mgerstner <matthias.gerstner@suse.com>
 
diff --git a/tboot.spec b/tboot.spec
index 5b782d8..d2bf47f 100644
--- a/tboot.spec
+++ b/tboot.spec
@@ -60,7 +60,10 @@ verified launch of an OS kernel/VMM.
 %patch8 -p1
 
 %build
-export CFLAGS="%{optflags}"
+# Tumbleweed now uses -flto=3 by default which gives us trouble with the
+# statically linked C and assembler code in tboot. Better to be conservative
+# here since tboot is low level stuff -> disable LTO for us.
+export CFLAGS="%{optflags} -fno-lto"
 export TBOOT_CFLAGS="$CFLAGS"
 make debug=y %{?_smp_mflags}