diff --git a/Makefile.cbm b/Makefile.cbm
index 1dbe4d7d1..7a16c7b6c 100644
--- a/Makefile.cbm
+++ b/Makefile.cbm
@@ -162,7 +162,11 @@ endif
 # shipped artifact. ELF-only: Apple's ld rejects -z noexecstack outright and it
 # is meaningless for PE, so it is gated rather than made "common".
 ELF_HARDENING_FLAGS :=
-ifeq ($(IS_LINUX),yes)
+# IS_LINUX comes from uname, i.e. the HOST. Cross-compiling to Windows from a
+# Linux container satisfies it while emitting PE, and lld then rejects the
+# unknown -z argument. Gate on the TARGET too: IS_MINGW is derived from the
+# compiler's own _WIN32 define, so it names what is actually being produced.
+ifeq ($(IS_LINUX)$(IS_MINGW),yesno)
 ELF_HARDENING_FLAGS := -Wl,-z,noexecstack
 endif