diff --git a/0028-cmake-modules-BuildBoost.cmake.patch b/0028-cmake-modules-BuildBoost.cmake.patch
new file mode 100644
index 0000000..3c31121
--- /dev/null
+++ b/0028-cmake-modules-BuildBoost.cmake.patch
@@ -0,0 +1,11 @@
+--- ceph-17.2.6/cmake/modules/BuildBoost.cmake.orig	2023-04-27 14:00:28.239524778 -0400
++++ ceph-17.2.6/cmake/modules/BuildBoost.cmake	2023-04-27 15:44:46.738462191 -0400
+@@ -63,7 +63,7 @@
+   else()
+     list(APPEND boost_features "address-model=32")
+   endif()
+-  set(BOOST_CXXFLAGS "-fPIC -w") # check on arm, etc <---XXX
++  set(BOOST_CXXFLAGS "-fPIC -w -fcf-protection") # check on arm, etc <---XXX
+   list(APPEND boost_features "cxxflags=${BOOST_CXXFLAGS}")
+ 
+   set(boost_with_libs)
diff --git a/ceph.spec b/ceph.spec
index fed97ce..dd25c46 100644
--- a/ceph.spec
+++ b/ceph.spec
@@ -160,7 +160,7 @@
 #################################################################################
 Name:		ceph
 Version:	17.2.6
-Release:	2%{?dist}
+Release:	3%{?dist}
 %if 0%{?fedora} || 0%{?rhel}
 Epoch:		2
 %endif
@@ -194,6 +194,7 @@ Patch0024:	0024-gcc-13.patch
 Patch0025:	0025-selinux-prepare-for-anon-inode-controls-enablement.patch
 Patch0026:	0026-src-boost-libs-python-src-object.patch
 Patch0027:	0027-src-rocksdb-table-block_based-data_block_hash_index.h.patch
+Patch0028:	0028-cmake-modules-BuildBoost.cmake.patch
 # ceph 14.0.1 does not support 32-bit architectures, bugs #1727788, #1727787
 ExcludeArch:	i686 armv7hl
 %if 0%{?suse_version}
@@ -2618,6 +2619,9 @@ exit 0
 %config %{_sysconfdir}/prometheus/ceph/ceph_default_alerts.yml
 
 %changelog
+* Thu Apr 27 2023 Kaleb S. KEITHLEY <kkeithle[at]redhat.com> - 2:17.2.6-3
+- ceph-17.2.6, rebuild boost with -fcf-protection
+
 * Thu Apr 20 2023 Kaleb S. KEITHLEY <kkeithle[at]redhat.com> - 2:17.2.6-2
 - ceph-17.2.6, rebuild with bundled rocksdb until ready for rocksdb-8.x