diff --git a/cert.S b/cert.S
index 36970330a..9642efc3a 100644
--- a/cert.S
+++ b/cert.S
@@ -52,3 +52,4 @@ vendor_deauthorized:
 #endif
 .Lvendor_deauthorized_end:
 .Lcert_table_end:
+	.section .note.GNU-stack,"a"
diff --git a/gnu-efi b/gnu-efi
index 03670e14f..39d4b348e 160000
--- a/gnu-efi
+++ b/gnu-efi
@@ -1 +1 @@
-Subproject commit 03670e14f263ad571bf0f39dffa9b8d23535f4d3
+Subproject commit 39d4b348e0aaee43a27602961b0281df99c06957
diff --git a/sbat_var.S b/sbat_var.S
index 2a813a403..7854ade3f 100644
--- a/sbat_var.S
+++ b/sbat_var.S
@@ -20,3 +20,4 @@ sbat_var_payload_header:
 .Lsbat_var_latest:
 	.ascii SBAT_VAR_LATEST
 	.byte 0
+	.section .note.GNU-stack,"a"