diff --git a/.ci/build-linux-aarch64.sh b/.ci/build-linux-aarch64.sh
index 50247786fe..c0f1720142 100755
--- a/.ci/build-linux-aarch64.sh
+++ b/.ci/build-linux-aarch64.sh
@@ -22,15 +22,16 @@ else
     export CXX="${CLANGXX_BINARY}"
     export LINKER="${LLD_BINARY}"
 fi
-export CFLAGS="$CFLAGS -fuse-ld=${LINKER}"
-export CXXFLAGS="$CXXFLAGS -fuse-ld=${LINKER}"
+
+export LINKER_FLAG="-fuse-ld=${LINKER}"
 
 cmake ..                                               \
     -DCMAKE_INSTALL_PREFIX=/usr                        \
     -DUSE_NATIVE_INSTRUCTIONS=OFF                      \
     -DUSE_PRECOMPILED_HEADERS=OFF                      \
-    -DCMAKE_C_FLAGS="$CFLAGS"                          \
-    -DCMAKE_CXX_FLAGS="$CFLAGS"                        \
+    -DCMAKE_EXE_LINKER_FLAGS="${LINKER_FLAG}"          \
+    -DCMAKE_MODULE_LINKER_FLAGS="${LINKER_FLAG}"       \
+    -DCMAKE_SHARED_LINKER_FLAGS="${LINKER_FLAG}"       \
     -DUSE_SYSTEM_CURL=ON                               \
     -DUSE_SDL=ON                                       \
     -DUSE_SYSTEM_SDL=ON                                \
diff --git a/.ci/build-linux.sh b/.ci/build-linux.sh
index e1466d1c01..f323dab8ec 100755
--- a/.ci/build-linux.sh
+++ b/.ci/build-linux.sh
@@ -30,7 +30,7 @@ else
     export RANLIB=/usr/bin/llvm-ranlib-"$LLVMVER"
 fi
 
-export CFLAGS="$CFLAGS -fuse-ld=${LINKER}"
+export LINKER_FLAG="-fuse-ld=${LINKER}"
 
 cmake ..                                               \
     -DCMAKE_INSTALL_PREFIX=/usr                        \
@@ -38,6 +38,9 @@ cmake ..                                               \
     -DUSE_PRECOMPILED_HEADERS=OFF                      \
     -DCMAKE_C_FLAGS="$CFLAGS"                          \
     -DCMAKE_CXX_FLAGS="$CFLAGS"                        \
+    -DCMAKE_EXE_LINKER_FLAGS="${LINKER_FLAG}"          \
+    -DCMAKE_MODULE_LINKER_FLAGS="${LINKER_FLAG}"       \
+    -DCMAKE_SHARED_LINKER_FLAGS="${LINKER_FLAG}"       \
     -DCMAKE_AR="$AR"                                   \
     -DCMAKE_RANLIB="$RANLIB"                           \
     -DUSE_SYSTEM_CURL=ON                               \
diff --git a/3rdparty/miniupnp/miniupnp b/3rdparty/miniupnp/miniupnp
index 7f189988a0..d66872e34d 160000
--- a/3rdparty/miniupnp/miniupnp
+++ b/3rdparty/miniupnp/miniupnp
@@ -1 +1 @@
-Subproject commit 7f189988a0decca0ab7da89000051ab91751f70d
+Subproject commit d66872e34d9ff83a07f8b71371b13419b2089953
diff --git a/3rdparty/wolfssl/wolfssl b/3rdparty/wolfssl/wolfssl
index 239b85c804..b077c81eb6 160000
--- a/3rdparty/wolfssl/wolfssl
+++ b/3rdparty/wolfssl/wolfssl
@@ -1 +1 @@
-Subproject commit 239b85c80438bf60d9a5b9e0ebe9ff097a760d0d
+Subproject commit b077c81eb635392e694ccedbab8b644297ec0285
diff --git a/buildfiles/cmake/ConfigureCompiler.cmake b/buildfiles/cmake/ConfigureCompiler.cmake
index 172ba9545e..d58baab29b 100644
--- a/buildfiles/cmake/ConfigureCompiler.cmake
+++ b/buildfiles/cmake/ConfigureCompiler.cmake
@@ -93,6 +93,9 @@ else()
 		add_compile_options(-Wno-class-memaccess)
 	endif()
 
+	# Note that this refers to binary size optimization during linking, it differs from optimization compiler level
+	add_link_options(-Wl,-O2)
+
 	if(NOT APPLE AND NOT WIN32)
 		# This hides our LLVM from mesa's LLVM, otherwise we get some unresolvable conflicts.
 		add_link_options(-Wl,--exclude-libs,ALL)