diff --git a/debian/changelog b/debian/changelog
index 853faefb..dcd7ce22 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -27,6 +27,19 @@ llvm-toolchain-snapshot (1:18~++20230725115106+b6847edfc235-1~exp1) experimental
 
  -- Sylvestre Ledru <sylvestre@debian.org>  Tue, 25 Jul 2023 23:52:42 +0200
 
+llvm-toolchain-17 (1:17.0.0~+rc4-1~exp4) experimental; urgency=medium
+
+  * Also ignore "-mbranch-protection=standard" (used on arm64)
+
+ -- Sylvestre Ledru <sylvestre@debian.org>  Fri, 08 Sep 2023 13:49:38 +0200
+
+llvm-toolchain-17 (1:17.0.0~+rc4-1~exp3) experimental; urgency=medium
+
+  * Update control file
+  * Fixup build failures from 16 branch
+
+ -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 07 Sep 2023 23:04:28 +0200
+
 llvm-toolchain-17 (1:17.0.0~+rc4-1~exp2) experimental; urgency=medium
 
   * Strip -fcf-protection for wasm build - new flag added in dpkg 1.22
@@ -131,12 +144,23 @@ llvm-toolchain-snapshot (1:17~++20230128060150+75153adeda1a-1~exp1) experimental
 
  -- Sylvestre Ledru <sylvestre@debian.org>  Sat, 28 Jan 2023 18:07:40 +0100
 
-llvm-toolchain-16 (1:16.0.6-13) UNRELEASED; urgency=medium
+llvm-toolchain-16 (1:16.0.6-14) UNRELEASED; urgency=medium
 
+  * On bionic & buster, for apt.llvm.org, pass -DLLVM_ENABLE_ZSTD=OFF
+    as libzstd is too old
+
+ -- Sylvestre Ledru <sylvestre@debian.org>  Fri, 08 Sep 2023 17:26:20 +0200
+
+llvm-toolchain-16 (1:16.0.6-13) unstable; urgency=medium
+
+  [ Gianfranco Costamagna ]
   * Also runtime-depend on {libzstd,zlib1g}-dev, from Paravoid (Closes:
     #1047718)
 
- -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 07 Sep 2023 01:43:23 +0200
+  [ Sylvestre Ledru ]
+  * Strip -fcf-protection for wasm build - new flag added in dpkg 1.22
+
+ -- Sylvestre Ledru <sylvestre@debian.org>  Thu, 07 Sep 2023 13:01:14 +0200
 
 llvm-toolchain-16 (1:16.0.6-12) unstable; urgency=medium
 
diff --git a/debian/rules b/debian/rules
index bde2151c..036ab2e2 100755
--- a/debian/rules
+++ b/debian/rules
@@ -423,6 +423,12 @@ ifneq (,$(filter $(DEB_HOST_ARCH_OS),linux))
 	STAGE_2_CMAKE_EXTRA += -DLLVM_USE_PERF=ON -DLLVM_ENABLE_LIBPFM=ON
 endif
 
+LLVM_ENABLE_ZSTD_DISABLE_DISTRO := bionic buster
+# Disable zstd on old distro, fails on lld
+ifeq (,$(filter-out $(LLVM_ENABLE_ZSTD_DISABLE_DISTRO), $(DISTRO)))
+       STAGE_ALL_CMAKE_EXTRA += -DLLVM_ENABLE_ZSTD=OFF
+endif
+
 LTO_ENABLE=no
 # Only enable it for archs supporting gold
 ifneq (,$(filter $(DEB_HOST_ARCH),$(BINUTILS_GOLD_ARCHS)))
@@ -815,8 +821,8 @@ endif
 	touch $@
 
 # Remove some new flags introduced by dpkg 1.22.0;
-STAGE_2_WASM_CFLAGS := $(shell echo $(STAGE_2_CFLAGS) | sed -e "s/-fcf-protection//g")
-STAGE_2_WASM_CXXFLAGS := $(shell echo $(STAGE_2_CXXFLAGS) | sed -e "s/-fcf-protection//g")
+STAGE_2_WASM_CFLAGS := $(shell echo $(STAGE_2_CFLAGS) | sed -e "s/-fcf-protection//g" -e "s/-mbranch-protection=standard//g")
+STAGE_2_WASM_CXXFLAGS := $(shell echo $(STAGE_2_CXXFLAGS) | sed -e "s/-fcf-protection//g" -e "s/-mbranch-protection=standard//g")
 
 build-wasm/compiler-rt-%: cpu = $(@:build-wasm/compiler-rt-%=%)
 build-wasm/compiler-rt-%:
@@ -896,8 +902,8 @@ build-wasm/libcxx-%-wasi: build-wasm/compiler-rt-%
 		-DCMAKE_CXX_COMPILER=$(STAGE_2_BIN_DIR)/clang++ \
 		-DCMAKE_AR=$(STAGE_2_BIN_DIR)/llvm-ar \
 		-DCMAKE_RANLIB=$(STAGE_2_BIN_DIR)/llvm-ranlib \
-		-DCMAKE_C_FLAGS="$(opt_flags) $(STAGE_2_CFLAGS) -fno-stack-protector" \
-		-DCMAKE_CXX_FLAGS="$(opt_flags) $(STAGE_2_CXXFLAGS) -fno-stack-protector" \
+		-DCMAKE_C_FLAGS="$(opt_flags) $(STAGE_2_WASM_CFLAGS) -fno-stack-protector" \
+		-DCMAKE_CXX_FLAGS="$(opt_flags) $(STAGE_2_WASM_CXXFLAGS) -fno-stack-protector" \
 		-DCMAKE_SHARED_LINKER_FLAGS="$(LDFLAGS) -L$(STAGE_2_LIB_DIR)" \
 		-DCMAKE_MODULE_LINKER_FLAGS="$(LDFLAGS) -L$(STAGE_2_LIB_DIR)" \
 		-DCMAKE_EXE_LINKER_FLAGS="$(LDFLAGS) -L$(STAGE_2_LIB_DIR)" \