diff --git a/sane-backends.spec b/sane-backends.spec
index c3ae471..f55120d 100644
--- a/sane-backends.spec
+++ b/sane-backends.spec
@@ -1,7 +1,7 @@
 Summary: Scanner access software
 Name: sane-backends
 Version: 1.0.21
-Release: 2%{?dist}
+Release: 3%{?dist}
 # lib/ is LGPLv2+, backends are GPLv2+ with exceptions
 # Tools are GPLv2+, docs are public domain
 # see LICENSE for details
@@ -90,6 +90,10 @@ want to access digital cameras.
 %patch100 -p1 -b .automake
 
 %build
+# use PIC/PIE because SANE-enabled software is likely to deal with data coming
+# from untrusted sources (client <-> saned via network)
+CFLAGS="-fPIC %optflags -fno-strict-aliasing"
+LDFLAGS="-pie"
 %configure \
     --with-gphoto2=%{_prefix} \
     --with-docdir=%{_docdir}/%{name}-%{version} \
@@ -158,6 +162,11 @@ rm -rf %{buildroot}
 %{_libdir}/pkgconfig/sane-backends.pc
 
 %changelog
+* Fri Jun 25 2010 Nils Philippsen <nils@redhat.com> - 1.0.21-3
+- build with -fno-strict-aliasing
+- use PIC/PIE because SANE-enabled software is likely to deal with data coming
+  from untrusted sources (client <-> saned via network)
+
 * Mon Jun 07 2010 Nils Philippsen <nils@redhat.com>
 - rectify devel subpackage description