diff --git a/interfaces/innerkits/code_sign_utils/BUILD.gn b/interfaces/innerkits/code_sign_utils/BUILD.gn
index a7812558b05d642dc90bfc5a1c189dce50ecddb6..4a49de1bcb6672ca24e2a3ec031b27acd5fb4d3e 100644
--- a/interfaces/innerkits/code_sign_utils/BUILD.gn
+++ b/interfaces/innerkits/code_sign_utils/BUILD.gn
@@ -19,6 +19,12 @@ config("public_code_sign_utils_configs") {
 }
 
 ohos_shared_library("libcode_sign_utils") {
+  sanitize = {
+    cfi = true
+    cfi_cross_dso = true
+    debug = false
+  }
+  branch_protector_ret = "pac_ret"
   sources = [
     "${code_signature_root_dir}/utils/src/code_sign_block.cpp",
     "${code_signature_root_dir}/utils/src/file_helper.cpp",
diff --git a/utils/BUILD.gn b/utils/BUILD.gn
index 885f1c63733966583b967ba640720c0a39af075c..3e62d764fb935e8023d17d88717a5924a3d66db7 100644
--- a/utils/BUILD.gn
+++ b/utils/BUILD.gn
@@ -15,6 +15,12 @@ import("//build/ohos.gni")
 import("../code_signature.gni")
 
 ohos_source_set("fsverity_sign_src_set") {
+  sanitize = {
+    cfi = true
+    cfi_cross_dso = true
+    debug = false
+  }
+  branch_protector_ret = "pac_ret"
   sources = [
     "src/fsverity_utils_helper.cpp",
     "src/openssl_utils.cpp",