diff --git a/debian/changelog b/debian/changelog
index 3e8ac9a3..02a06598 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+llvm-toolchain-17 (1:17.0.0~+rc4-1~exp2) experimental; urgency=medium
+
+  * Strip -fcf-protection for wasm build - new flag added in dpkg 1.22
+
+ -- Sylvestre Ledru <sylvestre@debian.org>  Wed, 06 Sep 2023 22:44:15 +0200
+
 llvm-toolchain-16 (1:16.0.6-13) UNRELEASED; urgency=medium
 
   * Also runtime-depend on {libzstd,zlib1g}-dev, from Paravoid (Closes:
diff --git a/debian/rules b/debian/rules
index 6f4a607a..b9b1eb73 100755
--- a/debian/rules
+++ b/debian/rules
@@ -787,6 +787,10 @@ ifndef LLVM_SPIRV
 endif
 	touch $@
 
+# Remove some new flags introduced by dpkg 1.22.0;
+STAGE_2_WASM_CFLAGS := $(shell echo $(STAGE_2_CFLAGS) | sed -e "s/-fcf-protection//g")
+STAGE_2_WASM_CXXFLAGS := $(shell echo $(STAGE_2_CXXFLAGS) | sed -e "s/-fcf-protection//g")
+
 build-wasm/compiler-rt-%: cpu = $(@:build-wasm/compiler-rt-%=%)
 build-wasm/compiler-rt-%:
 	@echo "Building compiler-rt for $(cpu)"
@@ -801,8 +805,8 @@ build-wasm/compiler-rt-%:
 		-DCMAKE_ASM_COMPILER_TARGET=$(cpu)-unknown-unknown \
 		-DCMAKE_C_COMPILER=$(STAGE_2_BIN_DIR)/clang \
 		-DCMAKE_CXX_COMPILER=$(STAGE_2_BIN_DIR)/clang++ \
-		-DCMAKE_C_FLAGS="$(opt_flags) $(STAGE_2_CFLAGS)" \
-		-DCMAKE_CXX_FLAGS="$(opt_flags) $(STAGE_2_CXXFLAGS)" \
+		-DCMAKE_C_FLAGS="$(opt_flags) $(STAGE_2_WASM_CFLAGS)" \
+		-DCMAKE_CXX_FLAGS="$(opt_flags) $(STAGE_2_WASM_CXXFLAGS)" \
 		-DCMAKE_SHARED_LINKER_FLAGS="$(STAGE_2_LDFLAGS) -L$(STAGE_2_LIB_DIR)" \
 		-DCMAKE_MODULE_LINKER_FLAGS="$(STAGE_2_LDFLAGS) -L$(STAGE_2_LIB_DIR)" \
 		-DCMAKE_EXE_LINKER_FLAGS="$(STAGE_2_LDFLAGS) -L$(STAGE_2_LIB_DIR)" \