-hibernate_restore.o_CFLAGS_ADD += -fno-stack-protector
-hibernate_bootstrap.o_CFLAGS_ADD += -fno-stack-protector
+# Unconfigured __HIB files must be Mach-O for "setsegname"
+WKdmDecompress_new.o_CFLAGS_ADD += -fno-stack-protector $(CFLAGS_NOLTO_FLAG)
+WKdmData_new.o_CFLAGS_ADD += -fno-stack-protector $(CFLAGS_NOLTO_FLAG)
+hibernate_restore.o_CFLAGS_ADD += -fno-stack-protector $(CFLAGS_NOLTO_FLAG)
+hibernate_bootstrap.o_CFLAGS_ADD += -fno-stack-protector $(CFLAGS_NOLTO_FLAG)
+bcopy.o_CFLAGS_ADD += -fno-stack-protector $(CFLAGS_NOLTO_FLAG)
+bzero.o_CFLAGS_ADD += -fno-stack-protector $(CFLAGS_NOLTO_FLAG)
+
+# To appear at the beginning of the __HIB segment, emit
+# as Mach-O so that the linker can enforce symbol order
+boot_pt.o_CFLAGS_ADD += $(CFLAGS_NOLTO_FLAG)