diff --git a/cc/config/arm64_device.go b/cc/config/arm64_device.go
index bdcbd05e0..13e9a08ba 100644
--- a/cc/config/arm64_device.go
+++ b/cc/config/arm64_device.go
@@ -38,18 +38,11 @@ var (
 	}
 
 	arm64Ldflags = []string{
-		"-Wl,-z,noexecstack",
-		"-Wl,-z,relro",
-		"-Wl,-z,now",
-		"-Wl,--build-id=md5",
-		"-Wl,--warn-shared-textrel",
-		"-Wl,--fatal-warnings",
 		"-Wl,-m,aarch64_elf64_le_vec",
 		"-Wl,--hash-style=gnu",
 		"-Wl,--fix-cortex-a53-843419",
 		"-fuse-ld=gold",
 		"-Wl,--icf=safe",
-		"-Wl,--no-undefined-version",
 	}
 
 	arm64Cppflags = []string{
diff --git a/cc/config/arm_device.go b/cc/config/arm_device.go
index 3411e074f..80ec3240f 100644
--- a/cc/config/arm_device.go
+++ b/cc/config/arm_device.go
@@ -45,15 +45,8 @@ var (
 	}
 
 	armLdflags = []string{
-		"-Wl,-z,noexecstack",
-		"-Wl,-z,relro",
-		"-Wl,-z,now",
-		"-Wl,--build-id=md5",
-		"-Wl,--warn-shared-textrel",
-		"-Wl,--fatal-warnings",
 		"-Wl,--icf=safe",
 		"-Wl,--hash-style=gnu",
-		"-Wl,--no-undefined-version",
 		"-Wl,-m,armelf",
 	}
 
diff --git a/cc/config/global.go b/cc/config/global.go
index 4a2f6065a..7362f2e51 100644
--- a/cc/config/global.go
+++ b/cc/config/global.go
@@ -71,8 +71,20 @@ var (
 		"-Werror=format-security",
 	}
 
+	deviceGlobalLdflags = []string{
+		"-Wl,-z,noexecstack",
+		"-Wl,-z,relro",
+		"-Wl,-z,now",
+		"-Wl,--build-id=md5",
+		"-Wl,--warn-shared-textrel",
+		"-Wl,--fatal-warnings",
+		"-Wl,--no-undefined-version",
+	}
+
 	hostGlobalCflags = []string{}
 
+	hostGlobalLdflags = []string{}
+
 	commonGlobalCppflags = []string{
 		"-Wsign-promo",
 	}
@@ -110,7 +122,9 @@ func init() {
 	pctx.StaticVariable("CommonGlobalCflags", strings.Join(commonGlobalCflags, " "))
 	pctx.StaticVariable("CommonGlobalConlyflags", strings.Join(commonGlobalConlyflags, " "))
 	pctx.StaticVariable("DeviceGlobalCflags", strings.Join(deviceGlobalCflags, " "))
+	pctx.StaticVariable("DeviceGlobalLdflags", strings.Join(deviceGlobalLdflags, " "))
 	pctx.StaticVariable("HostGlobalCflags", strings.Join(hostGlobalCflags, " "))
+	pctx.StaticVariable("HostGlobalLdflags", strings.Join(hostGlobalLdflags, " "))
 	pctx.StaticVariable("NoOverrideGlobalCflags", strings.Join(noOverrideGlobalCflags, " "))
 
 	pctx.StaticVariable("CommonGlobalCppflags", strings.Join(commonGlobalCppflags, " "))
diff --git a/cc/config/mips64_device.go b/cc/config/mips64_device.go
index 9dd116520..487b11a1a 100644
--- a/cc/config/mips64_device.go
+++ b/cc/config/mips64_device.go
@@ -45,14 +45,7 @@ var (
 	}
 
 	mips64Ldflags = []string{
-		"-Wl,-z,noexecstack",
-		"-Wl,-z,relro",
-		"-Wl,-z,now",
-		"-Wl,--build-id=md5",
-		"-Wl,--warn-shared-textrel",
-		"-Wl,--fatal-warnings",
 		"-Wl,--allow-shlib-undefined",
-		"-Wl,--no-undefined-version",
 	}
 
 	mips64ArchVariantCflags = map[string][]string{
diff --git a/cc/config/mips_device.go b/cc/config/mips_device.go
index 840702acd..f178b978c 100644
--- a/cc/config/mips_device.go
+++ b/cc/config/mips_device.go
@@ -43,14 +43,7 @@ var (
 	}
 
 	mipsLdflags = []string{
-		"-Wl,-z,noexecstack",
-		"-Wl,-z,relro",
-		"-Wl,-z,now",
-		"-Wl,--build-id=md5",
-		"-Wl,--warn-shared-textrel",
-		"-Wl,--fatal-warnings",
 		"-Wl,--allow-shlib-undefined",
-		"-Wl,--no-undefined-version",
 	}
 
 	mipsToolchainLdflags = []string{
diff --git a/cc/config/x86_64_device.go b/cc/config/x86_64_device.go
index 1941eb8d5..1eab9dd65 100644
--- a/cc/config/x86_64_device.go
+++ b/cc/config/x86_64_device.go
@@ -34,14 +34,7 @@ var (
 	x86_64Cppflags = []string{}
 
 	x86_64Ldflags = []string{
-		"-Wl,-z,noexecstack",
-		"-Wl,-z,relro",
-		"-Wl,-z,now",
-		"-Wl,--build-id=md5",
-		"-Wl,--warn-shared-textrel",
-		"-Wl,--fatal-warnings",
 		"-Wl,--hash-style=gnu",
-		"-Wl,--no-undefined-version",
 	}
 
 	x86_64ArchVariantCflags = map[string][]string{
diff --git a/cc/config/x86_device.go b/cc/config/x86_device.go
index a95305bc0..8aea64d9c 100644
--- a/cc/config/x86_device.go
+++ b/cc/config/x86_device.go
@@ -40,14 +40,7 @@ var (
 	x86Cppflags = []string{}
 
 	x86Ldflags = []string{
-		"-Wl,-z,noexecstack",
-		"-Wl,-z,relro",
-		"-Wl,-z,now",
-		"-Wl,--build-id=md5",
-		"-Wl,--warn-shared-textrel",
-		"-Wl,--fatal-warnings",
 		"-Wl,--hash-style=gnu",
-		"-Wl,--no-undefined-version",
 	}
 
 	x86ArchVariantCflags = map[string][]string{
diff --git a/cc/linker.go b/cc/linker.go
index 1cf3f6137..d5727aa07 100644
--- a/cc/linker.go
+++ b/cc/linker.go
@@ -196,7 +196,13 @@ func (linker *baseLinker) linkerDeps(ctx BaseModuleContext, deps Deps) Deps {
 func (linker *baseLinker) linkerFlags(ctx ModuleContext, flags Flags) Flags {
 	toolchain := ctx.toolchain()
 
+	hod := "Host"
+	if ctx.Os().Class == android.Device {
+		hod = "Device"
+	}
+
 	if !ctx.noDefaultCompilerFlags() {
+		flags.LdFlags = append(flags.LdFlags, fmt.Sprintf("${config.%sGlobalLdflags}", hod))
 		if Bool(linker.Properties.Allow_undefined_symbols) {
 			if ctx.Darwin() {
 				// darwin defaults to treating undefined symbols as errors
diff --git a/cc/makevars.go b/cc/makevars.go
index 295b4ac00..f84ae24e2 100644
--- a/cc/makevars.go
+++ b/cc/makevars.go
@@ -174,6 +174,7 @@ func makeVarsToolchain(ctx android.MakeVarsContext, secondPrefix string,
 		toolchain.Cppflags(),
 	}, " "))
 	ctx.Strict(makePrefix+"GLOBAL_LDFLAGS", strings.Join([]string{
+		fmt.Sprintf("${config.%sGlobalLdflags}", hod),
 		toolchain.Ldflags(),
 		toolchain.ToolchainLdflags(),
 		productExtraLdflags,
@@ -219,6 +220,7 @@ func makeVarsToolchain(ctx android.MakeVarsContext, secondPrefix string,
 			toolchain.ClangCppflags(),
 		}, " "))
 		ctx.Strict(clangPrefix+"GLOBAL_LDFLAGS", strings.Join([]string{
+			fmt.Sprintf("${config.%sGlobalLdflags}", hod),
 			toolchain.ClangLdflags(),
 			toolchain.ToolchainClangLdflags(),
 			productExtraLdflags,