diff --git a/GNUmakefile b/GNUmakefile
index 5de9b82d..6d14edd1 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -199,7 +199,6 @@ ANDROID_RELEASE_TARGETS := $(filter-out $(DEBUG_TARGETS),$(ANDROID_TARGETS))
 NONANDROID_RELEASE_TARGETS := $(filter-out $(ANDROID_ARM64_TARGETS),$(RELEASE_TARGETS))
 NONANDROID_TARGETS := $(filter-out $(ANDROID_TARGETS),$(ALL_TARGETS))
 NONMACOS_TARGETS := $(filter-out $(MACOS_TARGETS) $(IOS_TARGETS) $(IOSSIM_TARGETS),$(ALL_TARGETS))
-DEADSTRIP_TARGETS := $(filter-out $(ANDROID_TARGETS),$(NONMACOS_TARGETS))
 ifneq ($(UNAME_S),OpenBSD)
 $(NONMACOS_TARGETS): LDFLAGS += -static-libgcc
 endif
@@ -268,7 +267,8 @@ $(ANDROID_X86_TARGETS): LDFLAGS += -Lout/openssl/android/x86/usr/local/lib
 $(ANDROID_X86_64_TARGETS): CFLAGS += -Iout/openssl/android/x86_64/usr/local/include
 $(ANDROID_X86_64_TARGETS): LDFLAGS += -Lout/openssl/android/x86_64/usr/local/lib
 $(NONMACOS_TARGETS): CFLAGS += -Wno-cast-function-type
-$(DEADSTRIP_TARGETS): LDFLAGS += -Wl,--gc-sections
+$(MACOS_TARGETS): LDFLAGS += -Wl,-dead_strip
+$(NONMACOS_TARGETS): LDFLAGS += -Wl,--gc-sections -Wl,--as-needed
 $(IOS_TARGETS): CFLAGS += -miphoneos-version-min=9.0
 $(IOS_TARGETS): LDFLAGS += -miphoneos-version-min=9.0
 ifeq ($(UNAME_S),Darwin)
@@ -1144,17 +1144,17 @@ $(ANDROID_DEPS):
 	+@export ANDROID_NDK_ROOT=$(ANDROID_NDK)
 	+@export BUILD_PLATFORM=android
 	+@export TOOLCHAIN=$(ANDROID_NDK)/toolchains/llvm/prebuilt/linux-x86_64
-	+@PATH="$$TOOLCHAIN/x86_64-linux-android/bin:$$TOOLCHAIN/bin:$$PATH" BUILD_TARGET=x86_64 SSL_TARGET=android-x86_64 OPTIONS="--static -static -ffunction-sections -fdata-sections -D__ANDROID_API__=$(ANDROID_MIN_SDK_VERSION) -Wno-macro-redefined" tools/ssl-local
-	+@PATH="$$TOOLCHAIN/i686-linux-android/bin:$$TOOLCHAIN/bin:$$PATH" BUILD_TARGET=x86 SSL_TARGET=android-x86 OPTIONS="--static -static -ffunction-sections -fdata-sections -D__ANDROID_API__=$(ANDROID_MIN_SDK_VERSION) -Wno-macro-redefined" tools/ssl-local
-	+@PATH="$$TOOLCHAIN/arm-linux-androideabi/bin:$$TOOLCHAIN/bin:$$PATH" BUILD_TARGET=armeabi-v7a SSL_TARGET=android-arm OPTIONS="--static -static -ffunction-sections -fdata-sections --target=armv7a-linux-androideabi -Wl,--fix-cortex-a8 -D__ANDROID_API__=$(ANDROID_MIN_SDK_VERSION) -Wno-macro-redefined" tools/ssl-local
-	+@PATH="$$TOOLCHAIN/aarch64-linux-android/bin:$$TOOLCHAIN/bin:$$PATH" BUILD_TARGET=arm64-v8a SSL_TARGET=android-arm64 OPTIONS="--static -static -ffunction-sections -fdata-sections -D__ANDROID_API__=$(ANDROID_MIN_SDK_VERSION) -Wno-macro-redefined" tools/ssl-local
+	+@PATH="$$TOOLCHAIN/x86_64-linux-android/bin:$$TOOLCHAIN/bin:$$PATH" BUILD_TARGET=x86_64 SSL_TARGET=android-x86_64 OPTIONS="-D__ANDROID_API__=$(ANDROID_MIN_SDK_VERSION) -Wno-macro-redefined" tools/ssl-local
+	+@PATH="$$TOOLCHAIN/i686-linux-android/bin:$$TOOLCHAIN/bin:$$PATH" BUILD_TARGET=x86 SSL_TARGET=android-x86 OPTIONS="-D__ANDROID_API__=$(ANDROID_MIN_SDK_VERSION) -Wno-macro-redefined" tools/ssl-local
+	+@PATH="$$TOOLCHAIN/arm-linux-androideabi/bin:$$TOOLCHAIN/bin:$$PATH" BUILD_TARGET=armeabi-v7a SSL_TARGET=android-arm OPTIONS="--target=armv7a-linux-androideabi -Wl,--fix-cortex-a8 -D__ANDROID_API__=$(ANDROID_MIN_SDK_VERSION) -Wno-macro-redefined" tools/ssl-local
+	+@PATH="$$TOOLCHAIN/aarch64-linux-android/bin:$$TOOLCHAIN/bin:$$PATH" BUILD_TARGET=arm64-v8a SSL_TARGET=android-arm64 OPTIONS="-D__ANDROID_API__=$(ANDROID_MIN_SDK_VERSION) -Wno-macro-redefined" tools/ssl-local
 $(filter $(BUILD_DIR)/android%,$(APP_OBJS)): | $(ANDROID_DEPS)
 
 ifeq ($(UNAME_S),Linux)
 ifneq ($(USE_SYSTEM_SSL),1)
 LOCAL_DEPS := out/openssl/$(UNAME_S)/$(UNAME_M)/usr/local/lib/libssl.a
 $(LOCAL_DEPS):
-	+@/usr/bin/env bash tools/ssl-local
+	+@tools/ssl-local
 $(filter $(BUILD_DIR)/debug/%,$(APP_OBJS)) $(filter $(BUILD_DIR)/release/%,$(APP_OBJS)): | $(LOCAL_DEPS)
 endif
 
@@ -1198,8 +1198,8 @@ endif
 ifeq ($(UNAME_S),Darwin)
 IOS_DEPS := out/openssl/ios/ios64-xcrun/usr/local/lib/libssl.a
 $(IOS_DEPS):
-	+@BUILD_PLATFORM=ios BUILD_TARGET=ios64-xcrun SSL_TARGET=ios64-xcrun OPTIONS="--static -static -Os -ffunction-sections -fdata-sections -fPIC -Wno-macro-redefined -miphoneos-version-min=9.0" tools/ssl-local
-	+@BUILD_PLATFORM=ios BUILD_TARGET=iossimulator-xcrun SSL_TARGET=iossimulator-xcrun OPTIONS="--static -static -Os -ffunction-sections -fdata-sections -fPIC -Wno-macro-redefined" tools/ssl-local
+	+@BUILD_PLATFORM=ios BUILD_TARGET=ios64-xcrun SSL_TARGET=ios64-xcrun OPTIONS="-fPIC -Wno-macro-redefined -miphoneos-version-min=9.0" tools/ssl-local
+	+@BUILD_PLATFORM=ios BUILD_TARGET=iossimulator-xcrun SSL_TARGET=iossimulator-xcrun OPTIONS="-fPIC -Wno-macro-redefined" tools/ssl-local
 $(filter $(BUILD_DIR)/ios%,$(APP_OBJS)): | $(IOS_DEPS)
 endif
 
diff --git a/tools/ssl-local b/tools/ssl-local
index 67c34696..d3f729e8 100755
--- a/tools/ssl-local
+++ b/tools/ssl-local
@@ -22,63 +22,66 @@ pwd
 pushd $WORK_DIR || exit 128
 rm -rf $DESTDIR
 echo $PATH
-export GLOBAL_OPTIONS="
-no-apps
-no-asm
-no-async
-no-autoerrinit
-no-autoload-config
-no-cmp
-no-cms
-no-comp
-no-deprecated
-no-dgram
-no-docs
-no-dsa
-no-dso
-no-dtls
-no-dtls1
-no-dtls1-method
-no-dynamic-engine
-no-ec2m
-no-egd
-no-engine
-no-err
-no-filenames
-no-gost
-no-http
-no-idea
-no-legacy
-no-md2
-no-md4
-no-module
-no-multiblock
-no-nextprotoneg
-no-ocsp
-no-psk
-no-shared
-no-sock
-no-srp
-no-ssl
-no-ssl3
-no-ssl-trace
-no-stdio
-no-tests
-no-thread-pool
-no-threads
-no-tls1
-no-tls1-method
-no-trace
-no-ui-console
-no-uplink
-no-weak-ssl-ciphers
-no-whirlpool
-no-zlib
--Os
--DOPENSSL_SMALL_FOOTPRINT
--Wno-error
--ffunction-sections
--fdata-sections"
+export GLOBAL_OPTIONS=" \
+no-apps \
+no-asm \
+no-async \
+no-autoerrinit \
+no-autoload-config \
+no-cmp \
+no-cms \
+no-comp \
+no-deprecated \
+no-dgram \
+no-docs \
+no-dsa \
+no-dso \
+no-dtls \
+no-dtls1 \
+no-dtls1-method \
+no-dynamic-engine \
+no-ec2m \
+no-egd \
+no-engine \
+no-err \
+no-filenames \
+no-gost \
+no-http \
+no-idea \
+no-legacy \
+no-md2 \
+no-md4 \
+no-module \
+no-multiblock \
+no-nextprotoneg \
+no-ocsp \
+no-psk \
+no-shared \
+no-sock \
+no-srp \
+no-ssl \
+no-ssl3 \
+no-ssl-trace \
+no-stdio \
+no-tests \
+no-thread-pool \
+no-threads \
+no-tls1 \
+no-tls1-method \
+no-trace \
+no-ui-console \
+no-uplink \
+no-weak-ssl-ciphers \
+no-whirlpool \
+no-zlib \
+-Os \
+-DOPENSSL_SMALL_FOOTPRINT \
+-Wno-error \
+-ffunction-sections \
+-fdata-sections \
+--static \
+-static \
+"
 pwd
 echo "./Configure $SSL_TARGET $OPTIONS $GLOBAL_OPTIONS" && \
 ./Configure $SSL_TARGET $OPTIONS $GLOBAL_OPTIONS && \