diff --git a/xen/Makefile b/xen/Makefile
index 2ac6ec5adc..30db57cc3c 100644
--- a/xen/Makefile
+++ b/xen/Makefile
@@ -397,6 +397,8 @@ endif
 
 AFLAGS += -D__ASSEMBLY__
 
+$(call cc-option-add,AFLAGS,CC,-Wa$(comma)--noexecstack)
+
 LDFLAGS-$(call ld-option,--warn-rwx-segments) += --no-warn-rwx-segments
 
 CFLAGS += $(CFLAGS-y)