diff --git a/.build.sh b/.build.sh
index 5bdee2e..63a4bbb 100644
--- a/.build.sh
+++ b/.build.sh
@@ -20,8 +20,17 @@ clone () {
 # optimizations
 set_cflags () {
   export \
-    CFLAGS="-Ofast" CPPFLAGS="-Ofast" LDFLAGS="-Wl,-O3 -Wl,-S" \
-    RUSTFLAGS="-C target-cpu=native"
+    CFLAGS="-std=gnu2x -Ofast -march=native" \
+    CPPFLAGS="-Ofast -march=native" \
+    LDFLAGS="-Wl,-O3" \
+    RUSTFLAGS="-C target-cpu=native -C panic=abort"
+}
+
+# in a separate fn because ring does not build with LTO
+use_lto () {
+  export \
+    CFLAGS="$CFLAGS -flto=auto -fwhole-program" \
+    CPPFLAGS="$CPPFLAGS -flto=auto -fwhole-program"
 }
 
 # make -j12
diff --git a/build_dig.sh b/build_dig.sh
index 3bb8b40..b9784b9 100755
--- a/build_dig.sh
+++ b/build_dig.sh
@@ -16,6 +16,7 @@ clone https://gitlab.isc.org/isc-projects/bind9.git bind9
 cd bind9
 trap 'cd ..' EXIT
 set_cflags
+use_lto
 
 echo
 echo '==> autoreconf -fi'
diff --git a/build_drill.sh b/build_drill.sh
index 06312d0..83c9cfb 100755
--- a/build_drill.sh
+++ b/build_drill.sh
@@ -17,6 +17,7 @@ clone https://github.com/NLnetLabs/ldns.git ldns
 cd ldns
 trap 'cd ..' EXIT
 set_cflags
+use_lto
 
 echo
 echo '==> libtoolize -ci'