diff --git a/lib/Makefile b/lib/Makefile
index 93c41973..fdbea4b2 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -4,10 +4,14 @@ LIBMAJOR	= 0
 LIBMINOR	= 0
 LIBMICRO	= 0
 LIBXBPS_SHLIB	= libxbps.so.$(LIBMAJOR).$(LIBMINOR).$(LIBMICRO)
-LIBXBPS_LDFLAGS	= -shared -Wl,-soname,libxbps.so.$(LIBMAJOR)
+SHAREDLIB_LDFLAGS = -lprop -larchive
+ifdef WITH_SSL
+SHAREDLIB_LDFLAGS += -lssl
+endif
+SHAREDLIB_LDFLAGS += -shared -Wl,-soname,libxbps.so.$(LIBMAJOR)
 
 # libfetch
-OBJS = fetch/common.o fetch/fetch.o fetch/file.o fetch/ftp.o fetch/http.o
+LIBFETCH_OBJS = fetch/common.o fetch/fetch.o fetch/file.o fetch/ftp.o fetch/http.o
 
 # libxbps
 OBJS +=	configure.o cmpver.o depends.o download.o fexec.o findpkg.o
@@ -15,29 +19,26 @@ OBJS +=	humanize_number.o orphans.o plist.o purge.o register.o remove.o
 OBJS +=	repository.o requiredby.o sha256.o sortdeps.o state.o
 OBJS +=	sync_remote_pkgidx.o unpack.o util.o pkgmatch.o
 
+.PHONY: all
 ifdef STATIC
 all: libfetch libxbps.a
 else
-LDFLAGS = -lprop -larchive
-ifdef WITH_SSL
-LDFLAGS += -lssl -lcrypto
-endif
 all: libfetch libxbps.so libxbps.a
 endif
-.PHONY: all
 
 libfetch:
 	$(MAKE) -C fetch
 
 %.o: %.c
-	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -c $<
+	$(CC) $(CPPFLAGS) $(SHAREDLIB_CFLAGS) $(CFLAGS) \
+		$(LDFLAGS) $(STATIC_LIBS) -c $<
 
-libxbps.so: $(OBJS)
-	$(CC) $(LDFLAGS) $(LIBXBPS_LDFLAGS) $^ -o $(LIBXBPS_SHLIB)
+libxbps.so: $(OBJS) $(LIBFETCH_OBJS)
+	$(CC) $(LDFLAGS) $(SHAREDLIB_LDFLAGS) $^ -o $(LIBXBPS_SHLIB)
 	-ln -sf $(LIBXBPS_SHLIB) libxbps.so.$(LIBMAJOR)
 	-ln -sf $(LIBXBPS_SHLIB) libxbps.so
 
-libxbps.a: $(OBJS)
+libxbps.a: $(OBJS) $(LIBFETCH_OBJS)
 	$(AR) rcs $@ $^
 	ranlib $@
 
diff --git a/lib/fetch/Makefile b/lib/fetch/Makefile
index 0ac83f94..32c94f10 100644
--- a/lib/fetch/Makefile
+++ b/lib/fetch/Makefile
@@ -12,19 +12,16 @@ ifdef WITH_SSL
 CPPFLAGS += -DWITH_SSL
 endif
 
-ifdef STATIC
-CFLAGS += -static
-endif
-
 OBJS= fetch.o common.o ftp.o http.o file.o
 INCS= common.h
 GEN = ftperr.h httperr.h
 
 .PHONY: all
-all: $(OBJS)
+all: $(INCS) $(GEN) $(OBJS)
 
 %.o: %.c $(INCS) $(GEN)
-	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -c $<
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) \
+		$(SHAREDLIB_CFLAGS) -c $<
 
 ftperr.h: ftp.errors
 	./errlist.sh ftp_errlist FTP ftp.errors > $@
diff --git a/prog.mk b/prog.mk
index 77deb2cc..ddd80c4f 100644
--- a/prog.mk
+++ b/prog.mk
@@ -1,11 +1,12 @@
 OBJS ?=	main.o
 MAN ?= $(BIN).8
 
+LDFLAGS += -lxbps
+
 ifdef STATIC
 all: $(BIN).static
 MAN =
 else
-LDFLAGS += -lxbps
 all: $(BIN) $(MAN)
 endif
 
@@ -15,10 +16,11 @@ $(MAN):
 	a2x -f manpage $(MAN).txt
 
 $(BIN).static: $(OBJS)
-	$(CC) $^ -static -lxbps $(LDFLAGS) -o $@
+	$(CC) $^ $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) \
+		$(STATIC_LIBS) -o $@
 
 $(BIN): $(OBJS)
-	$(CC) $^ $(LDFLAGS) -o $@
+	$(CC) $^ $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o $@
 
 .PHONY: clean
 clean:
diff --git a/vars.mk b/vars.mk
index 129d247b..0b41ec4c 100644
--- a/vars.mk
+++ b/vars.mk
@@ -19,16 +19,16 @@ endif
 LDFLAGS =  -L$(TOPDIR)/lib
 CPPFLAGS += -I$(TOPDIR)/include -D_XOPEN_SOURCE=600 -D_GNU_SOURCE
 CPPFLAGS += -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGE_FILES
+SHAREDLIB_CFLAGS = -fvisibility=hidden
 WARNFLAGS ?= -pedantic -std=c99 -Wall -Wextra -Werror -Wshadow -Wformat=2
 WARNFLAGS += -Wmissing-declarations -Wcomment -Wunused-macros -Wendif-labels
-WARNFLAGS += -Wcast-qual -Wcast-align
-CFLAGS = $(DEBUG_FLAGS) $(WARNFLAGS)
+WARNFLAGS += -Wcast-qual -Wcast-align -Wstack-protector
+CFLAGS = $(DEBUG_FLAGS) $(WARNFLAGS) -fstack-protector-all
 
 ifdef STATIC
 CFLAGS += -static
-LDFLAGS += -lprop -lpthread -larchive -lssl -lcrypto -ldl -lacl \
-	  -lattr -lcrypto -llzma -lbz2 -lz
+STATIC_LIBS =	-lprop -lpthread -larchive -lssl -lcrypto -ldl -lacl \
+		-lattr -lcrypto -llzma -lbz2 -lz
 else
-CFLAGS += -fvisibility=hidden -fstack-protector-all -fPIC -DPIC
-CPPFLAGS += -Wstack-protector
+CFLAGS += -fPIC -DPIC
 endif