diff --git a/openjdk-latest.spec b/openjdk-latest.spec
index 0684b2febef489483a6032e3362ff9e93bfc9d21..d35a6506d0ea91e7f69aaf4746f42a447ee8389b 100644
--- a/openjdk-latest.spec
+++ b/openjdk-latest.spec
@@ -159,7 +159,7 @@
 # buildjdkver is usually same as %%{majorver},
 # but in time of bootstrap of next jdk, it is majorver-1, 
 # and this it is better to change it here, on single place
-%global buildjdkver 16
+%global buildjdkver 17
 # We don't add any LTS designator for STS packages (this package).
 # Neither for Fedora nor EPEL which would have %%{rhel} macro defined.
  %global lts_designator ""
@@ -1256,8 +1256,8 @@ export CFLAGS="$CFLAGS -mieee"
 # We use ourcppflags because the OpenJDK build seems to
 # pass EXTRA_CFLAGS to the HotSpot C++ compiler...
 # Explicitly set the C++ standard as the default has changed on GCC >= 6
-EXTRA_CFLAGS="%ourcppflags"
-EXTRA_CPP_FLAGS="%ourcppflags"
+EXTRA_CFLAGS="%ourcppflags -fstack-protector-all"
+EXTRA_CPP_FLAGS="%ourcppflags -fstack-protector-all"
 
 %ifarch %{power64} ppc
 # fix rpmlint warnings
@@ -1732,8 +1732,8 @@ require "copy_jdk_configs.lua"
 
 
 %changelog
-* Wen Dec 8 2021 noah <hedongbo@huawei.com> - 1:17.0.1.12-1-rolling
-- Use jdk16 as bootjdk temporarily
+* Mon Dec 6 2021 noah <hedongbo@huawei.com> - 1:17.0.1.12-1-rolling
+- add Stack protection
 
 * Fri Nov 12 2021 noah <hedongbo@huawei.com> - 1:17.0.1.12-0-rolling
 - Update to jdk-17.0.1+12