diff --git a/Makefile b/Makefile
index e1fa881b2aa4..0e06827b1ca6 100644
--- a/Makefile
+++ b/Makefile
@@ -878,6 +878,12 @@ LDFLAGS_u-boot += $(LDFLAGS_FINAL)
 # Avoid 'Not enough room for program headers' error on binutils 2.28 onwards.
 LDFLAGS_u-boot += $(call ld-option, --no-dynamic-linker)
 
+# Avoid 'warning: u-boot-spl has a LOAD segment with RWX permissions'
+LDFLAGS_u-boot += $(call ld-option,--no-warn-rwx-segments)
+
+# Avoid 'missing .note.GNU-stack section implies executable stack'
+LDFLAGS_u-boot += -z noexecstack
+
 ifeq ($(CONFIG_ARC)$(CONFIG_NIOS2)$(CONFIG_X86)$(CONFIG_XTENSA),)
 LDFLAGS_u-boot += -Ttext $(CONFIG_SYS_TEXT_BASE)
 endif
diff --git a/board/work-microwave/work_92105/work_92105_display.c b/board/work-microwave/work_92105/work_92105_display.c
index ffa0fcfa874d..9605ee1877f9 100644
--- a/board/work-microwave/work_92105/work_92105_display.c
+++ b/board/work-microwave/work_92105/work_92105_display.c
@@ -17,6 +17,7 @@
 #include <asm/gpio.h>
 #include <spi.h>
 #include <i2c.h>
+#include <timestamp.h>
 #include <version.h>
 #include <vsprintf.h>
 
diff --git a/cmd/version.c b/cmd/version.c
index b2fffe997724..ec37c3da3194 100644
--- a/cmd/version.c
+++ b/cmd/version.c
@@ -6,7 +6,9 @@
 
 #include <common.h>
 #include <command.h>
+#include <timestamp.h>
 #include <version.h>
+#include <version_string.h>
 #include <linux/compiler.h>
 #ifdef CONFIG_SYS_COREBOOT
 #include <asm/arch/sysinfo.h>
diff --git a/common/main.c b/common/main.c
index 07b34bf2b05d..ea41b8d28151 100644
--- a/common/main.c
+++ b/common/main.c
@@ -10,7 +10,7 @@
 #include <autoboot.h>
 #include <cli.h>
 #include <console.h>
-#include <version.h>
+#include <version_string.h>
 
 /*
  * Board-specific Platform code can reimplement show_boot_progress () if needed
diff --git a/common/spl/spl.c b/common/spl/spl.c
index 927e07277846..9fb7d3e2cae4 100644
--- a/common/spl/spl.c
+++ b/common/spl/spl.c
@@ -17,6 +17,9 @@
 #include <asm/u-boot.h>
 #include <nand.h>
 #include <fat.h>
+#if CONFIG_IS_ENABLED(BANNER_PRINT)
+#include <timestamp.h>
+#endif
 #include <version.h>
 #include <image.h>
 #include <malloc.h>
diff --git a/drivers/video/cfb_console.c b/drivers/video/cfb_console.c
index 636c3e8c184d..275d3de5e9ee 100644
--- a/drivers/video/cfb_console.c
+++ b/drivers/video/cfb_console.c
@@ -66,7 +66,7 @@
 
 #include <common.h>
 #include <fdtdec.h>
-#include <version.h>
+#include <version_string.h>
 #include <malloc.h>
 #include <video.h>
 #include <linux/compiler.h>
@@ -116,7 +116,6 @@
  * Console device
  */
 
-#include <version.h>
 #include <linux/types.h>
 #include <stdio_dev.h>
 #include <video_font.h>
diff --git a/include/configs/evb_ast2600_spl.h b/include/configs/evb_ast2600_spl.h
index 23dd7ecd7fa1..ae3e628d55c3 100644
--- a/include/configs/evb_ast2600_spl.h
+++ b/include/configs/evb_ast2600_spl.h
@@ -26,12 +26,9 @@
 #define CONFIG_SPL_LOAD_FIT_ADDRESS	0x00010000
 
 /* Extra ENV for Boot Command */
-#define STR_HELPER(n)	#n
-#define STR(n)		STR_HELPER(n)
-
 #undef CONFIG_EXTRA_ENV_SETTINGS
 #define CONFIG_EXTRA_ENV_SETTINGS	\
-	"loadaddr=" STR(CONFIG_SYS_LOAD_ADDR) "\0"	\
+	"loadaddr=" __stringify(CONFIG_SYS_LOAD_ADDR) "\0"	\
 	"bootspi=fdt addr 20100000 && fdt header get fitsize totalsize && cp.b 20100000 ${loadaddr} ${fitsize} && bootm; echo Error loading kernel FIT image\0"	\
 	"verify=yes\0"	\
 	""
diff --git a/include/configs/evb_ast2600_spl_emmc.h b/include/configs/evb_ast2600_spl_emmc.h
index f627c37a16c2..c5f79c3da443 100644
--- a/include/configs/evb_ast2600_spl_emmc.h
+++ b/include/configs/evb_ast2600_spl_emmc.h
@@ -25,12 +25,9 @@
 #define CONFIG_SPL_BSS_MAX_SIZE		0x00100000
 
 /* Extra ENV for Boot Command */
-#define STR_HELPER(n)	#n
-#define STR(n)		STR_HELPER(n)
-
 #undef CONFIG_EXTRA_ENV_SETTINGS
 #define CONFIG_EXTRA_ENV_SETTINGS	\
-	"loadaddr=" STR(CONFIG_SYS_LOAD_ADDR) "\0"	\
+	"loadaddr=" __stringify(CONFIG_SYS_LOAD_ADDR) "\0"	\
 	"bootside=a\0"	\
 	"rootfs=rofs-a\0"	\
 	"setmmcargs=setenv bootargs ${bootargs} rootwait root=PARTLABEL=${rootfs}\0"	\
diff --git a/include/configs/evb_ast2600a1_spl.h b/include/configs/evb_ast2600a1_spl.h
index 006cc4345b6c..34d6f4f9339f 100644
--- a/include/configs/evb_ast2600a1_spl.h
+++ b/include/configs/evb_ast2600a1_spl.h
@@ -26,12 +26,9 @@
 #define CONFIG_SPL_LOAD_FIT_ADDRESS	0x00010000
 
 /* Extra ENV for Boot Command */
-#define STR_HELPER(n)	#n
-#define STR(n)		STR_HELPER(n)
-
 #undef CONFIG_EXTRA_ENV_SETTINGS
 #define CONFIG_EXTRA_ENV_SETTINGS	\
-	"loadaddr=" STR(CONFIG_SYS_LOAD_ADDR) "\0"	\
+	"loadaddr=" __stringify(CONFIG_SYS_LOAD_ADDR) "\0"	\
 	"bootspi=fdt addr 20100000 && fdt header get fitsize totalsize && cp.b 20100000 ${loadaddr} ${fitsize} && bootm; echo Error loading kernel FIT image\0"	\
 	"verify=yes\0"	\
 	""
diff --git a/include/image.h b/include/image.h
index 937c7eee8ffb..0e58ffb139fe 100644
--- a/include/image.h
+++ b/include/image.h
@@ -821,7 +821,13 @@ image_set_hdr_b(comp)		/* image_set_comp */
 
 static inline void image_set_name(image_header_t *hdr, const char *name)
 {
-	strncpy(image_get_name(hdr), name, IH_NMLEN);
+	/*
+	 * This is equivalent to: strncpy(image_get_name(hdr), name, IH_NMLEN);
+	 *
+	 * Use the tortured code below to avoid a warning with gcc 12. We do not
+	 * want to include a nul terminator if the name is of length IH_NMLEN
+	 */
+	memcpy(image_get_name(hdr), name, strnlen(name, IH_NMLEN));
 }
 
 int image_check_hcrc(const image_header_t *hdr);
diff --git a/include/version.h b/include/version.h
index 2d24451569d5..66845ef0c239 100644
--- a/include/version.h
+++ b/include/version.h
@@ -7,8 +7,6 @@
 #ifndef	__VERSION_H__
 #define	__VERSION_H__
 
-#include <timestamp.h>
-
 #ifndef DO_DEPS_ONLY
 #include "generated/version_autogenerated.h"
 #endif
@@ -16,7 +14,4 @@
 #define U_BOOT_VERSION_STRING U_BOOT_VERSION " (" U_BOOT_DATE " - " \
 	U_BOOT_TIME " " U_BOOT_TZ ")" CONFIG_IDENT_STRING
 
-#ifndef __ASSEMBLY__
-extern const char version_string[];
-#endif	/* __ASSEMBLY__ */
 #endif	/* __VERSION_H__ */
diff --git a/include/version_string.h b/include/version_string.h
new file mode 100644
index 000000000000..a89a6e43705e
--- /dev/null
+++ b/include/version_string.h
@@ -0,0 +1,8 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+
+#ifndef	__VERSION_STRING_H__
+#define	__VERSION_STRING_H__
+
+extern const char version_string[];
+
+#endif	/* __VERSION_STRING_H__ */
diff --git a/lib/display_options.c b/lib/display_options.c
index af1802ef992f..0be9377a10d1 100644
--- a/lib/display_options.c
+++ b/lib/display_options.c
@@ -7,7 +7,7 @@
 #include <common.h>
 #include <console.h>
 #include <div64.h>
-#include <version.h>
+#include <version_string.h>
 #include <linux/ctype.h>
 #include <asm/io.h>
 
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index f7a041296d3d..71d66aca25c0 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -347,7 +347,7 @@ ifdef builtin-target
 quiet_cmd_link_o_target = LD      $@
 # If the list of objects to link is empty, just create an empty built-in.o
 cmd_link_o_target = $(if $(strip $(obj-y)),\
-		      $(LD) $(ld_flags) -r -o $@ $(filter $(obj-y), $^) \
+		      $(LD) $(ld_flags) -z noexecstack -r -o $@ $(filter $(obj-y), $^) \
 		      $(cmd_secanalysis),\
 		      rm -f $@; $(AR) rcs$(KBUILD_ARFLAGS) $@)
 
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 70de9bb13a66..60c3706ea2cb 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -377,9 +377,11 @@ cmd_efi_objcopy = $(OBJCOPY) -j .header -j .text -j .sdata -j .data -j \
 $(obj)/%.efi: $(obj)/%_efi.so
 	$(call cmd,efi_objcopy)
 
+KBUILD_EFILDFLAGS = -nostdlib -zexecstack -znocombreloc -znorelro
+KBUILD_EFILDFLAGS += $(call ld-option,--no-warn-rwx-segments)
 quiet_cmd_efi_ld = LD      $@
-cmd_efi_ld = $(LD) -nostdlib -znocombreloc -T $(EFI_LDS_PATH) -shared \
-		-Bsymbolic -s $^ -o $@
+cmd_efi_ld = $(LD) $(KBUILD_EFILDFLAGS) -T $(EFI_LDS_PATH) \
+		-shared -Bsymbolic -s $^ -o $@
 
 EFI_LDS_PATH = $(srctree)/arch/$(ARCH)/lib/$(EFI_LDS)
 
diff --git a/scripts/Makefile.spl b/scripts/Makefile.spl
index dfa17f52552c..5f091c8082c0 100644
--- a/scripts/Makefile.spl
+++ b/scripts/Makefile.spl
@@ -330,6 +330,12 @@ LDFLAGS_$(SPL_BIN) += -T u-boot-spl.lds $(LDFLAGS_FINAL)
 # Avoid 'Not enough room for program headers' error on binutils 2.28 onwards.
 LDFLAGS_$(SPL_BIN) += $(call ld-option, --no-dynamic-linker)
 
+# Avoid 'warning: u-boot-spl has a LOAD segment with RWX permissions'
+LDFLAGS_$(SPL_BIN) += $(call ld-option,--no-warn-rwx-segments)
+
+# Avoid 'missing .note.GNU-stack section implies executable stack'
+LDFLAGS_$(SPL_BIN) += -z noexecstack
+
 # Pick the best-match (i.e. SPL_TEXT_BASE for SPL, TPL_TEXT_BASE for TPL)
 ifneq ($(CONFIG_$(SPL_TPL_)TEXT_BASE),)
 LDFLAGS_$(SPL_BIN) += -Ttext $(CONFIG_$(SPL_TPL_)TEXT_BASE)
diff --git a/test/print_ut.c b/test/print_ut.c
index f0f1d6010a16..cebd8b85e1a7 100644
--- a/test/print_ut.c
+++ b/test/print_ut.c
@@ -10,7 +10,7 @@
 #include <efi_api.h>
 #endif
 #include <display_options.h>
-#include <version.h>
+#include <version_string.h>
 
 #define FAKE_BUILD_TAG	"jenkins-u-boot-denx_uboot_dm-master-build-aarch64" \
 			"and a lot more text to come"