diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index 63720faf707..6032e53f0ba 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
     "LOCALEDIR=$(out)/share/locale"
   ];
 
+  hardening_pie = true;
+
   postBuild = optionalString stdenv.isLinux ''
     make -C contrib/wrt
   '';