diff --git a/shell.nix b/shell.nix
index 0da3540..2a63eb7 100644
--- a/shell.nix
+++ b/shell.nix
@@ -16,6 +16,14 @@
 pkgs.mkShell {
   name = "schos";
 
+  # Off, all of it. Nix's compiler wrapper adds -fPIC, -fstack-protector,
+  # -D_FORTIFY_SOURCE and friends to every compile, which is right for Linux
+  # programs and wrong for everything here: the kernel is freestanding and
+  # linked at fixed addresses, and the UEFI loader targets PE/COFF, where clang
+  # refuses -fPIC outright ("unsupported option '-fPIC' for target
+  # 'x86_64-unknown-windows-msvc'") and `make` stops at BOOTX64.EFI.
+  hardeningDisable = [ "all" ];
+
   nativeBuildInputs = with pkgs; [
     # The cross-compiler, and the reason this file exists. clang targets
     # bare-metal ELF, 16-bit code and PE/COFF from one install; lld-link is what