--- Makefile.in
+++ Makefile.in
@@ -149,7 +149,7 @@
 	$(LD) -o $@ ssh-keygen.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
 
 ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o readconf.o $(X509STORE_OBJS)
-	$(LD) -o $@ ssh-keysign.o readconf.o $(X509STORE_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBLDAP) $(LIBS)
+	$(LD) -o $@ ssh-keysign.o readconf.o $(X509STORE_OBJS) $(LDFLAGS) -Wl,-z,now -lssh -lopenbsd-compat $(LIBLDAP) $(LIBS)
 
 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
 	$(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)