diff --git a/meta-arm/recipes-bsp/hafnium/hafnium/host-ld.patch b/meta-arm/recipes-bsp/hafnium/hafnium/host-ld.patch
new file mode 100644
index 00000000..8e7fee25
--- /dev/null
+++ b/meta-arm/recipes-bsp/hafnium/hafnium/host-ld.patch
@@ -0,0 +1,21 @@
+We need to be sure that the host linker flags are passed to the kernel build,
+as otherwise it is possible that binaries are incorrectly linked. For example:
+
+HOSTCC scripts/extract-cert
+ld: .../recipe-sysroot-native/usr/lib/pkgconfig/../../../usr/lib/libcrypto.so: undefined reference to `pthread_once@GLIBC_2.34'
+
+Upstream-Status: Inappropriate
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+
+diff --git a/build/linux/linux.gni b/build/linux/linux.gni
+index 65cc9df..19adbfb 100644
+--- a/build/linux/linux.gni
++++ b/build/linux/linux.gni
+@@ -69,6 +70,7 @@ template("linux_kernel") {
+     "GCC_TOOLCHAIN_DIR=" + rebase_path("//prebuilts/linux-x64/gcc/bin"),
+     "ARCH=arm64",
+     "CROSS_COMPILE=aarch64-linux-gnu-",
++    "HOSTLDFLAGS=" + getenv("BUILD_LDFLAGS"),
+ 
+     # Build out-of-tree in `target_out_dir`.
+     "O=" + rebase_path(target_out_dir),
diff --git a/meta-arm/recipes-bsp/hafnium/hafnium_2.5.bb b/meta-arm/recipes-bsp/hafnium/hafnium_2.5.bb
index b6dd685c..ad00f290 100644
--- a/meta-arm/recipes-bsp/hafnium/hafnium_2.5.bb
+++ b/meta-arm/recipes-bsp/hafnium/hafnium_2.5.bb
@@ -11,6 +11,7 @@ inherit deploy python3native pkgconfig
 
 SRC_URI = "gitsm://git.trustedfirmware.org/hafnium/hafnium.git;protocol=https;branch=master \
            file://hashbang.patch \
+           file://host-ld.patch \
            file://pkg-config-native.patch \
            file://native-dtc.patch"
 SRCREV = "3a149eb219467c0d9336467ea1fb9d3fb65da94b"