diff --git a/packaging/flatpak/net.catcrafts.CrafterBuild.yaml b/packaging/flatpak/net.catcrafts.CrafterBuild.yaml
index 01e286e..7226ad1 100644
--- a/packaging/flatpak/net.catcrafts.CrafterBuild.yaml
+++ b/packaging/flatpak/net.catcrafts.CrafterBuild.yaml
@@ -46,14 +46,27 @@ modules:
     builddir: true
     subdir: llvm
     build-options:
-      # Debug info for all of LLVM would be a multi-gigabyte .Debug extension.
+      # flatpak-builder's default CFLAGS carry -g. For all of LLVM that is a
+      # 30 GB build tree and a multi-gigabyte .Debug extension, so build
+      # without debug info, strip, and skip the split. The hardening flags
+      # from the defaults stay.
       no-debuginfo: true
+      strip: true
+      cflags: -O2 -pipe -fexceptions -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protection
+      cflags-override: true
+      cxxflags: -O2 -pipe -fexceptions -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protection
+      cxxflags-override: true
     config-opts:
       - -DCMAKE_BUILD_TYPE=Release
       - -DLLVM_ENABLE_ASSERTIONS=OFF
       - -DLLVM_ENABLE_PROJECTS=clang;lld
       - -DLLVM_ENABLE_RUNTIMES=compiler-rt;libcxx;libcxxabi;libunwind
       - -DLLVM_TARGETS_TO_BUILD=X86;AArch64;WebAssembly
+      # Classic layout: libc++ in lib/ and include/c++/v1, not under a
+      # per-target subdirectory, the same shape as a distro install.
+      # crafter-build adds -L and an rpath for <prefix>/lib itself, since
+      # clang searches only its per-target directory and the system paths.
+      - -DLLVM_ENABLE_PER_TARGET_RUNTIME_DIR=OFF
       # One shared LLVM and one shared clang library instead of a statically
       # linked copy per tool: a fraction of the install size.
       - -DLLVM_BUILD_LLVM_DYLIB=ON
@@ -115,6 +128,16 @@ modules:
     builddir: true
     build-options:
       no-debuginfo: true
+      # flatpak-builder's default CFLAGS/LDFLAGS are x86-64 hardening flags
+      # (-fcf-protection, -z relro) that the nested wasm32 builds inherit
+      # through the environment and clang rejects for that target.
+      cflags: ""
+      cflags-override: true
+      cxxflags: ""
+      cxxflags-override: true
+      ldflags: ""
+      ldflags-override: true
+      strip: true
     config-opts:
       - -DCMAKE_TOOLCHAIN_FILE=/run/build/wasi-sysroot/wasi-host-toolchain.cmake
       - -DWASI_SDK_BUILD_TOOLCHAIN=OFF