diff --git a/CMakeLists.txt b/CMakeLists.txt
index 6c53f00..085f084 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -212,7 +212,17 @@ if(NOT CMAKE_CROSSCOMPILING)
                                                   STREQUAL arm64)
       set(hardening_check_arch_flags --nocfprotection)
     else()
-      set(hardening_check_arch_flags --nobranchprotection)
+      # --nobranchprotection was added in a newer version of hardening-check;
+      # older versions don't check for it either, so omitting the flag is safe.
+      execute_process(
+        COMMAND ${HARDENING_CHECK} --help
+        OUTPUT_VARIABLE _hardening_check_help
+        ERROR_VARIABLE _hardening_check_help)
+      if(_hardening_check_help MATCHES "nobranchprotection")
+        set(hardening_check_arch_flags --nobranchprotection)
+      else()
+        set(hardening_check_arch_flags "")
+      endif()
     endif()
     add_test(
       NAME hardening_check