diff --git a/src/codegen/llvm.zig b/src/codegen/llvm.zig
index 186dab61293ae7ccd8d00fa17d328959c8b62cc6..a146fed57f4d9a3ee582639d4f036ae30466ed88 100644
--- a/src/codegen/llvm.zig
+++ b/src/codegen/llvm.zig
@@ -395,7 +395,7 @@ pub const Object = struct {
         }
 
         {
-            var module_flags = try std.array_list.Managed(Builder.Metadata).initCapacity(o.gpa, 8);
+            var module_flags = try std.array_list.Managed(Builder.Metadata).initCapacity(o.gpa, 11);
             defer module_flags.deinit();
 
             const behavior_error = try o.builder.metadataConstant(try o.builder.intConst(.i32, 1));
@@ -492,6 +492,20 @@ pub const Object = struct {
                 }));
             }
 
+            // The frontend should eventually offer options to control these.
+            if (target.cpu.arch.isAarch64() and target.os.tag == .openbsd) {
+                module_flags.appendAssumeCapacity(try o.builder.metadataTuple(&.{
+                    behavior_min,
+                    (try o.builder.metadataString("branch-target-enforcement")).toMetadata(),
+                    try o.builder.metadataConstant(try o.builder.intConst(.i32, 2)),
+                }));
+                module_flags.appendAssumeCapacity(try o.builder.metadataTuple(&.{
+                    behavior_min,
+                    (try o.builder.metadataString("sign-return-address")).toMetadata(),
+                    try o.builder.metadataConstant(try o.builder.intConst(.i32, 2)),
+                }));
+            }
+
             try o.builder.addNamedMetadata(try o.builder.string("llvm.module.flags"), module_flags.items);
         }
 
@@ -2228,6 +2242,22 @@ pub const Object = struct {
             // above, this should be revisited if `softfp` support is added.
             try attributes.addFnAttr(.noimplicitfloat, &o.builder);
         }
+
+        // The frontend should eventually offer options to control these.
+        if (target.cpu.arch.isAarch64() and target.os.tag == .openbsd) {
+            try attributes.addFnAttr(.{ .string = .{
+                .kind = try o.builder.string("branch-target-enforcement"),
+                .value = try o.builder.string(""),
+            } }, &o.builder);
+            try attributes.addFnAttr(.{ .string = .{
+                .kind = try o.builder.string("sign-return-address"),
+                .value = try o.builder.string("non-leaf"),
+            } }, &o.builder);
+            try attributes.addFnAttr(.{ .string = .{
+                .kind = try o.builder.string("sign-return-address-key"),
+                .value = try o.builder.string("a_key"),
+            } }, &o.builder);
+        }
     }
 
     pub fn addCallingConventionFnAttributes(