diff --git a/CMakeLists.txt b/CMakeLists.txt
index 9346495fc65..0b18a35cff7 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -274,6 +274,13 @@ if(NOT "${SERENITY_ARCH}" STREQUAL "aarch64")
     if (ENABLE_MOLD_LINKER)
         add_link_options(-fuse-ld=mold)
     endif()
+
+    if (CMAKE_CXX_COMPILER_ID MATCHES "Clang$" OR USE_MOLD_LINKER)
+        add_link_options(LINKER:--pack-dyn-relocs=relr)
+    else()
+        add_link_options(LINKER:-z,pack-relative-relocs)
+    endif()
+
     add_subdirectory(Userland)
     add_subdirectory(Tests)
 endif()
diff --git a/Kernel/CMakeLists.txt b/Kernel/CMakeLists.txt
index d55b4d0e7d6..cdf1dca3254 100644
--- a/Kernel/CMakeLists.txt
+++ b/Kernel/CMakeLists.txt
@@ -422,6 +422,8 @@ if (CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
     link_directories(${TOOLCHAIN_ROOT}/lib/gcc/${SERENITY_ARCH}-pc-serenity/${GCC_VERSION}/)
 
     set(TARGET_STRING "")
+
+    add_link_options(LINKER:-z,pack-relative-relocs)
 else() # Assume Clang
     add_compile_options(-Waddress-of-packed-member)
     add_compile_options(-faligned-allocation)
@@ -429,7 +431,7 @@ else() # Assume Clang
     # We need this in order to pick up the #define __serenity__, otherwise we end up including unistd.h into the linker script
     set(TARGET_STRING "--target=${CMAKE_CXX_COMPILER_TARGET}")
     
-    add_link_options(LINKER:--build-id=none)
+    add_link_options(LINKER:--build-id=none LINKER:--pack-dyn-relocs=relr)
 endif()
 
 macro (set_new_alignment alignment)
diff --git a/Meta/serenity.sh b/Meta/serenity.sh
index 1ca60f52f58..44773cad66e 100755
--- a/Meta/serenity.sh
+++ b/Meta/serenity.sh
@@ -242,6 +242,21 @@ build_toolchain() {
 
 ensure_toolchain() {
     [ -d "$TOOLCHAIN_DIR" ] || build_toolchain
+
+    # FIXME: Remove this check when most people have already updated their toolchain
+    if [ "$TOOLCHAIN_TYPE" = "GNU" ]; then
+        local ld_version
+        ld_version="$("$TOOLCHAIN_DIR"/bin/"$TARGET"-pc-serenity-ld -v)"
+        local expected_version="GNU ld (GNU Binutils) 2.38"
+        if [ "$ld_version" != "$expected_version" ]; then
+            echo "Your toolchain has an old version of binutils installed."
+            echo "    installed version: \"$ld_version\""
+            echo "    expected version:  \"$expected_version\""
+            echo "Please run $ARG0 rebuild-toolchain $TARGET to update it."
+            exit 1
+        fi
+    fi
+
 }
 
 delete_toolchain() {