diff --git a/3.3/alpine3.23/Dockerfile b/3.3/alpine3.23/Dockerfile
index 63b92bd40..2722a3be9 100644
--- a/3.3/alpine3.23/Dockerfile
+++ b/3.3/alpine3.23/Dockerfile
@@ -95,6 +95,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/3.3/alpine3.24/Dockerfile b/3.3/alpine3.24/Dockerfile
index 118ae595d..8f45fa68b 100644
--- a/3.3/alpine3.24/Dockerfile
+++ b/3.3/alpine3.24/Dockerfile
@@ -95,6 +95,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/3.3/bookworm/Dockerfile b/3.3/bookworm/Dockerfile
index 3180158ff..1929fd1b2 100644
--- a/3.3/bookworm/Dockerfile
+++ b/3.3/bookworm/Dockerfile
@@ -63,6 +63,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/3.3/slim-bookworm/Dockerfile b/3.3/slim-bookworm/Dockerfile
index 340f84d36..39f73a23a 100644
--- a/3.3/slim-bookworm/Dockerfile
+++ b/3.3/slim-bookworm/Dockerfile
@@ -88,6 +88,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/3.3/slim-trixie/Dockerfile b/3.3/slim-trixie/Dockerfile
index 195313510..6e8503ff1 100644
--- a/3.3/slim-trixie/Dockerfile
+++ b/3.3/slim-trixie/Dockerfile
@@ -88,6 +88,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/3.3/trixie/Dockerfile b/3.3/trixie/Dockerfile
index f9fe3390c..202c46746 100644
--- a/3.3/trixie/Dockerfile
+++ b/3.3/trixie/Dockerfile
@@ -63,6 +63,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/3.4/alpine3.23/Dockerfile b/3.4/alpine3.23/Dockerfile
index df92bcf0a..2d338eaf5 100644
--- a/3.4/alpine3.23/Dockerfile
+++ b/3.4/alpine3.23/Dockerfile
@@ -95,6 +95,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/3.4/alpine3.24/Dockerfile b/3.4/alpine3.24/Dockerfile
index 6d0c21465..7d8956b6d 100644
--- a/3.4/alpine3.24/Dockerfile
+++ b/3.4/alpine3.24/Dockerfile
@@ -95,6 +95,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/3.4/bookworm/Dockerfile b/3.4/bookworm/Dockerfile
index 9472c0e27..0ba0464a3 100644
--- a/3.4/bookworm/Dockerfile
+++ b/3.4/bookworm/Dockerfile
@@ -63,6 +63,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/3.4/slim-bookworm/Dockerfile b/3.4/slim-bookworm/Dockerfile
index b1eccc954..f3e85b602 100644
--- a/3.4/slim-bookworm/Dockerfile
+++ b/3.4/slim-bookworm/Dockerfile
@@ -88,6 +88,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/3.4/slim-trixie/Dockerfile b/3.4/slim-trixie/Dockerfile
index 076061f05..88f391205 100644
--- a/3.4/slim-trixie/Dockerfile
+++ b/3.4/slim-trixie/Dockerfile
@@ -88,6 +88,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/3.4/trixie/Dockerfile b/3.4/trixie/Dockerfile
index 093b89ad4..df28804f6 100644
--- a/3.4/trixie/Dockerfile
+++ b/3.4/trixie/Dockerfile
@@ -63,6 +63,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/4.0/alpine3.23/Dockerfile b/4.0/alpine3.23/Dockerfile
index 715da445c..7a060eeef 100644
--- a/4.0/alpine3.23/Dockerfile
+++ b/4.0/alpine3.23/Dockerfile
@@ -95,6 +95,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/4.0/alpine3.24/Dockerfile b/4.0/alpine3.24/Dockerfile
index be49267ec..24d63d092 100644
--- a/4.0/alpine3.24/Dockerfile
+++ b/4.0/alpine3.24/Dockerfile
@@ -95,6 +95,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/4.0/bookworm/Dockerfile b/4.0/bookworm/Dockerfile
index e93a59fc8..4cd16ea88 100644
--- a/4.0/bookworm/Dockerfile
+++ b/4.0/bookworm/Dockerfile
@@ -63,6 +63,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/4.0/slim-bookworm/Dockerfile b/4.0/slim-bookworm/Dockerfile
index 020711eb7..6dcab2bb9 100644
--- a/4.0/slim-bookworm/Dockerfile
+++ b/4.0/slim-bookworm/Dockerfile
@@ -88,6 +88,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/4.0/slim-trixie/Dockerfile b/4.0/slim-trixie/Dockerfile
index 035a02667..67880db0f 100644
--- a/4.0/slim-trixie/Dockerfile
+++ b/4.0/slim-trixie/Dockerfile
@@ -88,6 +88,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/4.0/trixie/Dockerfile b/4.0/trixie/Dockerfile
index 8f3244b7c..036858b34 100644
--- a/4.0/trixie/Dockerfile
+++ b/4.0/trixie/Dockerfile
@@ -63,6 +63,10 @@ RUN set -eux; \
 	\
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \
diff --git a/Dockerfile.template b/Dockerfile.template
index 5fdb9cce7..3f1eeebdf 100644
--- a/Dockerfile.template
+++ b/Dockerfile.template
@@ -194,6 +194,10 @@ RUN set -eux; \
 {{ ) else "" end -}}
 	autoconf; \
 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup
+# https://github.com/docker-library/ruby/pull/529
+# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags)
+	export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \
 	./configure \
 		--build="$gnuArch" \
 		--disable-install-doc \