diff --git a/crypto/chacha/asm/chacha-x86_64.pl b/crypto/chacha/asm/chacha-x86_64.pl
index 31384de..418044c 100755
--- a/crypto/chacha/asm/chacha-x86_64.pl
+++ b/crypto/chacha/asm/chacha-x86_64.pl
@@ -231,6 +231,7 @@
 .align	64
 ChaCha20_ctr32:
 .cfi_startproc
+	_CET_ENDBR
 	cmp	\$0,$len
 	je	.Lno_data
 	mov	OPENSSL_ia32cap_P+4(%rip),%r10
diff --git a/crypto/cipher_extra/asm/aes128gcmsiv-x86_64.pl b/crypto/cipher_extra/asm/aes128gcmsiv-x86_64.pl
index f7d419b..e044259 100644
--- a/crypto/cipher_extra/asm/aes128gcmsiv-x86_64.pl
+++ b/crypto/cipher_extra/asm/aes128gcmsiv-x86_64.pl
@@ -134,6 +134,7 @@
 .align 16
 aesgcmsiv_htable_init:
 .cfi_startproc
+    _CET_ENDBR
     vmovdqa ($H), $T
     vmovdqa $T, $TMP0
     vmovdqa $T, ($Htbl)      # H
@@ -174,6 +175,7 @@
 .align 16
 aesgcmsiv_htable6_init:
 .cfi_startproc
+    _CET_ENDBR
     vmovdqa ($H), $T
     vmovdqa $T, $TMP0
     vmovdqa $T, ($Htbl)      # H
@@ -235,6 +237,7 @@
 .align 16
 aesgcmsiv_htable_polyval:
 .cfi_startproc
+    _CET_ENDBR
     test  $len, $len
     jnz   .Lhtable_polyval_start
     ret
@@ -420,6 +423,7 @@
 .align 16
 aesgcmsiv_polyval_horner:
 .cfi_startproc
+    _CET_ENDBR
     test $L, $L
     jnz .Lpolyval_horner_start
     ret
@@ -460,6 +464,7 @@
 .align 16
 aes128gcmsiv_aes_ks:
 .cfi_startproc
+    _CET_ENDBR
     vmovdqu (%rdi), %xmm1           # xmm1 = user key
     vmovdqa %xmm1, (%rsi)           # rsi points to output
 
@@ -521,6 +526,7 @@
 .align 16
 aes256gcmsiv_aes_ks:
 .cfi_startproc
+    _CET_ENDBR
     vmovdqu (%rdi), %xmm1
     vmovdqu 16(%rdi), %xmm3
     vmovdqa %xmm1, (%rsi)
@@ -614,6 +620,7 @@
 .align 16
 aes128gcmsiv_aes_ks_enc_x1:
 .cfi_startproc
+    _CET_ENDBR
     vmovdqa (%rcx), %xmm1                 # xmm1 = first 16 bytes of random key
     vmovdqa 0*16(%rdi), $BLOCK1
 
@@ -687,6 +694,7 @@
 .align 16
 aes128gcmsiv_kdf:
 .cfi_startproc
+    _CET_ENDBR
 # parameter 1: %rdi                         Pointer to NONCE
 # parameter 2: %rsi                         Pointer to CT
 # parameter 4: %rdx                         Pointer to keys
@@ -787,6 +795,7 @@
 .align 16
 aes128gcmsiv_enc_msg_x4:
 .cfi_startproc
+    _CET_ENDBR
     test $LEN, $LEN
     jnz .L128_enc_msg_x4_start
     ret
@@ -984,6 +993,7 @@
 .align 16
 aes128gcmsiv_enc_msg_x8:
 .cfi_startproc
+    _CET_ENDBR
     test $LEN, $LEN
     jnz .L128_enc_msg_x8_start
     ret
@@ -1239,6 +1249,7 @@
 
   $code.=<<___;
 .cfi_startproc
+    _CET_ENDBR
     test \$~15, $LEN
     jnz .L${labelPrefix}_dec_start
     ret
@@ -1578,6 +1589,7 @@
 .align 16
 aes128gcmsiv_ecb_enc_block:
 .cfi_startproc
+    _CET_ENDBR
     vmovdqa (%rdi), $STATE_1
 
     vpxor       ($KSp), $STATE_1, $STATE_1
@@ -1670,6 +1682,7 @@
 .align 16
 aes256gcmsiv_aes_ks_enc_x1:
 .cfi_startproc
+    _CET_ENDBR
     vmovdqa con1(%rip), $CON_MASK    # CON_MASK  = 1,1,1,1
     vmovdqa mask(%rip), $MASK_256    # MASK_256
     vmovdqa ($PT), $BLOCK1
@@ -1711,6 +1724,7 @@
 .align 16
 aes256gcmsiv_ecb_enc_block:
 .cfi_startproc
+    _CET_ENDBR
     vmovdqa (%rdi), $STATE_1
     vpxor ($KSp), $STATE_1, $STATE_1
     vaesenc 1*16($KSp), $STATE_1, $STATE_1
@@ -1794,6 +1808,7 @@
 .align 16
 aes256gcmsiv_enc_msg_x4:
 .cfi_startproc
+    _CET_ENDBR
     test $LEN, $LEN
     jnz .L256_enc_msg_x4_start
     ret
@@ -1994,6 +2009,7 @@
 .align 16
 aes256gcmsiv_enc_msg_x8:
 .cfi_startproc
+    _CET_ENDBR
     test $LEN, $LEN
     jnz .L256_enc_msg_x8_start
     ret
@@ -2200,6 +2216,7 @@
 .align 16
 aes256gcmsiv_kdf:
 .cfi_startproc
+    _CET_ENDBR
 # parameter 1: %rdi                         Pointer to NONCE
 # parameter 2: %rsi                         Pointer to CT
 # parameter 4: %rdx                         Pointer to keys
diff --git a/crypto/cipher_extra/asm/chacha20_poly1305_x86_64.pl b/crypto/cipher_extra/asm/chacha20_poly1305_x86_64.pl
index f0430c3..fb11760 100644
--- a/crypto/cipher_extra/asm/chacha20_poly1305_x86_64.pl
+++ b/crypto/cipher_extra/asm/chacha20_poly1305_x86_64.pl
@@ -449,6 +449,7 @@
 .align 64
 chacha20_poly1305_open:
 .cfi_startproc
+    _CET_ENDBR
     push %rbp
 .cfi_push %rbp
     push %rbx
@@ -871,6 +872,7 @@
 .align 64
 chacha20_poly1305_seal:
 .cfi_startproc
+    _CET_ENDBR
     push %rbp
 .cfi_push %rbp
     push %rbx
diff --git a/crypto/fipsmodule/aes/asm/aesni-x86_64.pl b/crypto/fipsmodule/aes/asm/aesni-x86_64.pl
index 215611f..414b76b 100644
--- a/crypto/fipsmodule/aes/asm/aesni-x86_64.pl
+++ b/crypto/fipsmodule/aes/asm/aesni-x86_64.pl
@@ -275,6 +275,7 @@
 .align	16
 ${PREFIX}_encrypt:
 .cfi_startproc
+	_CET_ENDBR
 #ifdef BORINGSSL_DISPATCH_TEST
 .extern	BORINGSSL_function_hit
 	movb \$1,BORINGSSL_function_hit+1(%rip)
@@ -297,6 +298,7 @@
 .align	16
 ${PREFIX}_decrypt:
 .cfi_startproc
+	_CET_ENDBR
 	movups	($inp),$inout0		# load input
 	mov	240($key),$rounds	# key->rounds
 ___
@@ -617,6 +619,7 @@
 .align	16
 ${PREFIX}_ecb_encrypt:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___ if ($win64);
 	lea	-0x58(%rsp),%rsp
@@ -1203,6 +1206,7 @@
 .align	16
 ${PREFIX}_ctr32_encrypt_blocks:
 .cfi_startproc
+	_CET_ENDBR
 #ifdef BORINGSSL_DISPATCH_TEST
 	movb \$1,BORINGSSL_function_hit(%rip)
 #endif
@@ -1781,6 +1785,7 @@
 .align	16
 ${PREFIX}_xts_encrypt:
 .cfi_startproc
+	_CET_ENDBR
 	lea	(%rsp),%r11			# frame pointer
 .cfi_def_cfa_register	%r11
 	push	%rbp
@@ -2264,6 +2269,7 @@
 .align	16
 ${PREFIX}_xts_decrypt:
 .cfi_startproc
+	_CET_ENDBR
 	lea	(%rsp),%r11			# frame pointer
 .cfi_def_cfa_register	%r11
 	push	%rbp
@@ -2782,6 +2788,7 @@
 .align	16
 ${PREFIX}_cbc_encrypt:
 .cfi_startproc
+	_CET_ENDBR
 	test	$len,$len		# check length
 	jz	.Lcbc_ret
 
@@ -3331,6 +3338,7 @@
 .align	16
 ${PREFIX}_set_decrypt_key:
 .cfi_startproc
+	_CET_ENDBR
 	.byte	0x48,0x83,0xEC,0x08	# sub rsp,8
 .cfi_adjust_cfa_offset	8
 	call	__aesni_set_encrypt_key
@@ -3403,6 +3411,7 @@
 ${PREFIX}_set_encrypt_key:
 __aesni_set_encrypt_key:
 .cfi_startproc
+	_CET_ENDBR
 #ifdef BORINGSSL_DISPATCH_TEST
 	movb \$1,BORINGSSL_function_hit+3(%rip)
 #endif
diff --git a/crypto/fipsmodule/aes/asm/vpaes-x86_64.pl b/crypto/fipsmodule/aes/asm/vpaes-x86_64.pl
index 37e93d7..4d0d38f 100644
--- a/crypto/fipsmodule/aes/asm/vpaes-x86_64.pl
+++ b/crypto/fipsmodule/aes/asm/vpaes-x86_64.pl
@@ -871,6 +871,7 @@
 .align	16
 ${PREFIX}_set_encrypt_key:
 .cfi_startproc
+	_CET_ENDBR
 #ifdef BORINGSSL_DISPATCH_TEST
 .extern        BORINGSSL_function_hit
        movb \$1, BORINGSSL_function_hit+5(%rip)
@@ -926,6 +927,7 @@
 .align	16
 ${PREFIX}_set_decrypt_key:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___ if ($win64);
 	lea	-0xb8(%rsp),%rsp
@@ -981,6 +983,7 @@
 .align	16
 ${PREFIX}_encrypt:
 .cfi_startproc
+	_CET_ENDBR
 #ifdef BORINGSSL_DISPATCH_TEST
 .extern        BORINGSSL_function_hit
        movb \$1, BORINGSSL_function_hit+4(%rip)
@@ -1030,6 +1033,7 @@
 .align	16
 ${PREFIX}_decrypt:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___ if ($win64);
 	lea	-0xb8(%rsp),%rsp
@@ -1081,6 +1085,7 @@
 .align	16
 ${PREFIX}_cbc_encrypt:
 .cfi_startproc
+	_CET_ENDBR
 	xchg	$key,$len
 ___
 ($len,$key)=($key,$len);
@@ -1166,6 +1171,7 @@
 .align	16
 ${PREFIX}_ctr32_encrypt_blocks:
 .cfi_startproc
+	_CET_ENDBR
 	# _vpaes_encrypt_core and _vpaes_encrypt_core_2x expect the key in %rdx.
 	xchg	$key, $blocks
 ___
diff --git a/crypto/fipsmodule/bn/asm/rsaz-avx2.pl b/crypto/fipsmodule/bn/asm/rsaz-avx2.pl
index 9be0b14..733722c 100755
--- a/crypto/fipsmodule/bn/asm/rsaz-avx2.pl
+++ b/crypto/fipsmodule/bn/asm/rsaz-avx2.pl
@@ -112,6 +112,7 @@
 .align	64
 rsaz_1024_sqr_avx2:		# 702 cycles, 14% faster than rsaz_1024_mul_avx2
 .cfi_startproc
+	_CET_ENDBR
 	lea	(%rsp), %rax
 .cfi_def_cfa_register	%rax
 	push	%rbx
@@ -863,6 +864,7 @@
 .align	64
 rsaz_1024_mul_avx2:
 .cfi_startproc
+	_CET_ENDBR
 	lea	(%rsp), %rax
 .cfi_def_cfa_register	%rax
 	push	%rbx
@@ -1474,6 +1476,7 @@
 .align	32
 rsaz_1024_red2norm_avx2:
 .cfi_startproc
+	_CET_ENDBR
 	sub	\$-128,$inp	# size optimization
 	xor	%rax,%rax
 ___
@@ -1515,6 +1518,7 @@
 .align	32
 rsaz_1024_norm2red_avx2:
 .cfi_startproc
+	_CET_ENDBR
 	sub	\$-128,$out	# size optimization
 	mov	($inp),@T[0]
 	mov	\$0x1fffffff,%eax
@@ -1559,6 +1563,7 @@
 .align	32
 rsaz_1024_scatter5_avx2:
 .cfi_startproc
+	_CET_ENDBR
 	vzeroupper
 	vmovdqu	.Lscatter_permd(%rip),%ymm5
 	shl	\$4,$power
@@ -1586,6 +1591,7 @@
 .align	32
 rsaz_1024_gather5_avx2:
 .cfi_startproc
+	_CET_ENDBR
 	vzeroupper
 	mov	%rsp,%r11
 .cfi_def_cfa_register	%r11
diff --git a/crypto/fipsmodule/bn/asm/x86_64-mont.pl b/crypto/fipsmodule/bn/asm/x86_64-mont.pl
index 8b34ae3..be4c69b 100755
--- a/crypto/fipsmodule/bn/asm/x86_64-mont.pl
+++ b/crypto/fipsmodule/bn/asm/x86_64-mont.pl
@@ -92,6 +92,7 @@
 .align	16
 bn_mul_mont:
 .cfi_startproc
+	_CET_ENDBR
 	mov	${num}d,${num}d
 	mov	%rsp,%rax
 .cfi_def_cfa_register	%rax
diff --git a/crypto/fipsmodule/bn/asm/x86_64-mont5.pl b/crypto/fipsmodule/bn/asm/x86_64-mont5.pl
index 67ffc4a..88d98af 100755
--- a/crypto/fipsmodule/bn/asm/x86_64-mont5.pl
+++ b/crypto/fipsmodule/bn/asm/x86_64-mont5.pl
@@ -79,6 +79,7 @@
 .align	64
 bn_mul_mont_gather5:
 .cfi_startproc
+	_CET_ENDBR
 	mov	${num}d,${num}d
 	mov	%rsp,%rax
 .cfi_def_cfa_register	%rax
@@ -1098,6 +1099,7 @@
 .align	32
 bn_power5:
 .cfi_startproc
+	_CET_ENDBR
 	mov	%rsp,%rax
 .cfi_def_cfa_register	%rax
 ___
@@ -1240,6 +1242,7 @@
 bn_sqr8x_internal:
 __bn_sqr8x_internal:
 .cfi_startproc
+	_CET_ENDBR
 	##############################################################
 	# Squaring part:
 	#
@@ -2737,6 +2740,7 @@
 bn_sqrx8x_internal:
 __bn_sqrx8x_internal:
 .cfi_startproc
+	_CET_ENDBR
 	##################################################################
 	# Squaring part:
 	#
@@ -3448,6 +3452,7 @@
 .align	16
 bn_scatter5:
 .cfi_startproc
+	_CET_ENDBR
 	cmp	\$0, $num
 	jz	.Lscatter_epilogue
 
@@ -3478,6 +3483,7 @@
 bn_gather5:
 .cfi_startproc
 .LSEH_begin_bn_gather5:			# Win64 thing, but harmless in other cases
+	_CET_ENDBR
 	# I can't trust assembler to use specific encoding:-(
 	.byte	0x4c,0x8d,0x14,0x24			#lea    (%rsp),%r10
 .cfi_def_cfa_register	%r10
diff --git a/crypto/fipsmodule/ec/asm/p256-x86_64-asm.pl b/crypto/fipsmodule/ec/asm/p256-x86_64-asm.pl
index 0701996..b6e0384 100755
--- a/crypto/fipsmodule/ec/asm/p256-x86_64-asm.pl
+++ b/crypto/fipsmodule/ec/asm/p256-x86_64-asm.pl
@@ -98,6 +98,7 @@
 .align	32
 ecp_nistz256_neg:
 .cfi_startproc
+	_CET_ENDBR
 	push	%r12
 .cfi_push	%r12
 	push	%r13
@@ -166,6 +167,7 @@
 .align	32
 ecp_nistz256_ord_mul_mont:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___	if ($addx);
 	leaq	OPENSSL_ia32cap_P(%rip), %rcx
@@ -497,6 +499,7 @@
 .align	32
 ecp_nistz256_ord_sqr_mont:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___	if ($addx);
 	leaq	OPENSSL_ia32cap_P(%rip), %rcx
@@ -1247,6 +1250,7 @@
 .align	32
 ecp_nistz256_mul_mont:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___	if ($addx);
 	leaq	OPENSSL_ia32cap_P(%rip), %rcx
@@ -1549,6 +1553,7 @@
 .align	32
 ecp_nistz256_sqr_mont:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___	if ($addx);
 	leaq	OPENSSL_ia32cap_P(%rip), %rcx
@@ -2098,6 +2103,7 @@
 .align	32
 ecp_nistz256_select_w5:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___	if ($avx>1);
 	leaq	OPENSSL_ia32cap_P(%rip), %rax
@@ -2198,6 +2204,7 @@
 .align	32
 ecp_nistz256_select_w7:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___	if ($avx>1);
 	leaq	OPENSSL_ia32cap_P(%rip), %rax
@@ -2403,6 +2410,7 @@
 ecp_nistz256_avx2_select_w7:
 .cfi_startproc
 .Lavx2_select_w7:
+	_CET_ENDBR
 	vzeroupper
 ___
 $code.=<<___	if ($win64);
@@ -2514,6 +2522,7 @@
 .type	ecp_nistz256_avx2_select_w7,\@function,3
 .align	32
 ecp_nistz256_avx2_select_w7:
+	_CET_ENDBR
 	.byte	0x0f,0x0b	# ud2
 	ret
 .size	ecp_nistz256_avx2_select_w7,.-ecp_nistz256_avx2_select_w7
@@ -2718,6 +2727,7 @@
 .align	32
 ecp_nistz256_point_double:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___	if ($addx);
 	leaq	OPENSSL_ia32cap_P(%rip), %rcx
@@ -2970,6 +2980,7 @@
 .align	32
 ecp_nistz256_point_add:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___	if ($addx);
 	leaq	OPENSSL_ia32cap_P(%rip), %rcx
@@ -3368,6 +3379,7 @@
 .align	32
 ecp_nistz256_point_add_affine:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___	if ($addx);
 	leaq	OPENSSL_ia32cap_P(%rip), %rcx
diff --git a/crypto/fipsmodule/ec/asm/p256_beeu-x86_64-asm.pl b/crypto/fipsmodule/ec/asm/p256_beeu-x86_64-asm.pl
index b9ec96d..1600d4c 100644
--- a/crypto/fipsmodule/ec/asm/p256_beeu-x86_64-asm.pl
+++ b/crypto/fipsmodule/ec/asm/p256_beeu-x86_64-asm.pl
@@ -154,6 +154,7 @@
 .align 32
 beeu_mod_inverse_vartime:
 .cfi_startproc
+    _CET_ENDBR
     push %rbp
 .cfi_push rbp
     push %r12
diff --git a/crypto/fipsmodule/md5/asm/md5-x86_64.pl b/crypto/fipsmodule/md5/asm/md5-x86_64.pl
index 4c96bba..655ea09 100644
--- a/crypto/fipsmodule/md5/asm/md5-x86_64.pl
+++ b/crypto/fipsmodule/md5/asm/md5-x86_64.pl
@@ -131,6 +131,7 @@
 .type md5_block_asm_data_order,\@function,3
 md5_block_asm_data_order:
 .cfi_startproc
+	_CET_ENDBR
 	push	%rbp
 .cfi_push	rbp
 	push	%rbx
diff --git a/crypto/fipsmodule/modes/asm/aesni-gcm-x86_64.pl b/crypto/fipsmodule/modes/asm/aesni-gcm-x86_64.pl
index 7c235f8..2530213 100644
--- a/crypto/fipsmodule/modes/asm/aesni-gcm-x86_64.pl
+++ b/crypto/fipsmodule/modes/asm/aesni-gcm-x86_64.pl
@@ -442,6 +442,7 @@
 aesni_gcm_decrypt:
 .cfi_startproc
 .seh_startproc
+	_CET_ENDBR
 	xor	%rax,%rax
 
 	# We call |_aesni_ctr32_ghash_6x|, which requires at least 96 (0x60)
@@ -715,6 +716,7 @@
 aesni_gcm_encrypt:
 .cfi_startproc
 .seh_startproc
+	_CET_ENDBR
 #ifdef BORINGSSL_DISPATCH_TEST
 .extern	BORINGSSL_function_hit
 	movb \$1,BORINGSSL_function_hit+2(%rip)
@@ -1089,6 +1091,7 @@
 .globl	aesni_gcm_encrypt
 .type	aesni_gcm_encrypt,\@abi-omnipotent
 aesni_gcm_encrypt:
+	_CET_ENDBR
 	xor	%eax,%eax
 	ret
 .size	aesni_gcm_encrypt,.-aesni_gcm_encrypt
@@ -1096,6 +1099,7 @@
 .globl	aesni_gcm_decrypt
 .type	aesni_gcm_decrypt,\@abi-omnipotent
 aesni_gcm_decrypt:
+	_CET_ENDBR
 	xor	%eax,%eax
 	ret
 .size	aesni_gcm_decrypt,.-aesni_gcm_decrypt
diff --git a/crypto/fipsmodule/modes/asm/ghash-ssse3-x86_64.pl b/crypto/fipsmodule/modes/asm/ghash-ssse3-x86_64.pl
index 00364f0..4a850f4 100644
--- a/crypto/fipsmodule/modes/asm/ghash-ssse3-x86_64.pl
+++ b/crypto/fipsmodule/modes/asm/ghash-ssse3-x86_64.pl
@@ -104,6 +104,7 @@
 gcm_gmult_ssse3:
 .cfi_startproc
 .seh_startproc
+	_CET_ENDBR
 ____
 $code .= <<____ if ($win64);
 	subq	\$40, %rsp
@@ -246,6 +247,7 @@
 gcm_ghash_ssse3:
 .cfi_startproc
 .seh_startproc
+	_CET_ENDBR
 ____
 $code .= <<____ if ($win64);
 	subq	\$56, %rsp
diff --git a/crypto/fipsmodule/modes/asm/ghash-x86_64.pl b/crypto/fipsmodule/modes/asm/ghash-x86_64.pl
index 19b18cc..8ad1104 100644
--- a/crypto/fipsmodule/modes/asm/ghash-x86_64.pl
+++ b/crypto/fipsmodule/modes/asm/ghash-x86_64.pl
@@ -206,6 +206,7 @@
 gcm_init_clmul:
 .cfi_startproc
 .seh_startproc
+	_CET_ENDBR
 .L_init_clmul:
 ___
 $code.=<<___ if ($win64);
@@ -288,6 +289,7 @@
 .align	16
 gcm_gmult_clmul:
 .cfi_startproc
+	_CET_ENDBR
 .L_gmult_clmul:
 	movdqu		($Xip),$Xi
 	movdqa		.Lbswap_mask(%rip),$T3
@@ -340,6 +342,7 @@
 gcm_ghash_clmul:
 .cfi_startproc
 .seh_startproc
+	_CET_ENDBR
 .L_ghash_clmul:
 ___
 $code.=<<___ if ($win64);
@@ -708,6 +711,7 @@
 .align	32
 gcm_init_avx:
 .cfi_startproc
+	_CET_ENDBR
 ___
 if ($avx) {
 my ($Htbl,$Xip)=@_4args;
@@ -853,6 +857,7 @@
 .align	32
 gcm_gmult_avx:
 .cfi_startproc
+	_CET_ENDBR
 	jmp	.L_gmult_clmul
 .cfi_endproc
 .size	gcm_gmult_avx,.-gcm_gmult_avx
@@ -864,6 +869,7 @@
 .align	32
 gcm_ghash_avx:
 .cfi_startproc
+	_CET_ENDBR
 ___
 if ($avx) {
 my ($Xip,$Htbl,$inp,$len)=@_4args;
diff --git a/crypto/fipsmodule/rand/asm/rdrand-x86_64.pl b/crypto/fipsmodule/rand/asm/rdrand-x86_64.pl
index ac442a9..c0cabe2 100644
--- a/crypto/fipsmodule/rand/asm/rdrand-x86_64.pl
+++ b/crypto/fipsmodule/rand/asm/rdrand-x86_64.pl
@@ -46,6 +46,7 @@
 .align	16
 CRYPTO_rdrand:
 .cfi_startproc
+	_CET_ENDBR
 	xorq %rax, %rax
 	rdrand $tmp1
 	# An add-with-carry of zero effectively sets %rax to the carry flag.
@@ -64,6 +65,7 @@
 .align 16
 CRYPTO_rdrand_multiple8_buf:
 .cfi_startproc
+	_CET_ENDBR
 	test $len, $len
 	jz .Lout
 	movq \$8, $tmp1
diff --git a/crypto/fipsmodule/sha/asm/sha1-x86_64.pl b/crypto/fipsmodule/sha/asm/sha1-x86_64.pl
index d9afacb..c2c8921 100755
--- a/crypto/fipsmodule/sha/asm/sha1-x86_64.pl
+++ b/crypto/fipsmodule/sha/asm/sha1-x86_64.pl
@@ -244,6 +244,7 @@
 .align	16
 sha1_block_data_order:
 .cfi_startproc
+	_CET_ENDBR
 	leaq	OPENSSL_ia32cap_P(%rip),%r10
 	mov	0(%r10),%r9d
 	mov	4(%r10),%r8d
diff --git a/crypto/fipsmodule/sha/asm/sha512-x86_64.pl b/crypto/fipsmodule/sha/asm/sha512-x86_64.pl
index e831ae5..35e88d9 100755
--- a/crypto/fipsmodule/sha/asm/sha512-x86_64.pl
+++ b/crypto/fipsmodule/sha/asm/sha512-x86_64.pl
@@ -263,6 +263,7 @@
 .align	16
 $func:
 .cfi_startproc
+	_CET_ENDBR
 ___
 $code.=<<___ if ($SZ==4 || $avx);
 	leaq	OPENSSL_ia32cap_P(%rip),%r11
diff --git a/crypto/hrss/asm/poly_rq_mul.S b/crypto/hrss/asm/poly_rq_mul.S
index 6d8b423..5241953 100644
--- a/crypto/hrss/asm/poly_rq_mul.S
+++ b/crypto/hrss/asm/poly_rq_mul.S
@@ -301,6 +301,7 @@
 .att_syntax prefix
 poly_Rq_mul:
 .cfi_startproc
+_CET_ENDBR
 push %rbp
 .cfi_adjust_cfa_offset 8
 .cfi_offset rbp, -16
diff --git a/crypto/perlasm/x86_64-xlate.pl b/crypto/perlasm/x86_64-xlate.pl
index b998050..e9fc322 100755
--- a/crypto/perlasm/x86_64-xlate.pl
+++ b/crypto/perlasm/x86_64-xlate.pl
@@ -1499,6 +1499,7 @@
 \%define XMMWORD
 \%define YMMWORD
 \%define ZMMWORD
+\%define _CET_ENDBR
 
 \%ifdef BORINGSSL_PREFIX
 \%include "boringssl_prefix_symbols_nasm.inc"
diff --git a/crypto/test/asm/trampoline-x86_64.pl b/crypto/test/asm/trampoline-x86_64.pl
index 75c85ec..53b4bcd 100755
--- a/crypto/test/asm/trampoline-x86_64.pl
+++ b/crypto/test/asm/trampoline-x86_64.pl
@@ -141,6 +141,7 @@
 abi_test_trampoline:
 .cfi_startproc
 .seh_startproc
+	_CET_ENDBR
 	# Stack layout:
 	#   8 bytes - align
 	#   $caller_state_size bytes - saved caller registers
@@ -307,6 +308,7 @@
 .globl	abi_test_clobber_r$_
 .align	16
 abi_test_clobber_r$_:
+	_CET_ENDBR
 	xorq	%r$_, %r$_
 	ret
 .size	abi_test_clobber_r$_,.-abi_test_clobber_r$_
@@ -319,6 +321,7 @@
 .globl	abi_test_clobber_xmm$_
 .align	16
 abi_test_clobber_xmm$_:
+	_CET_ENDBR
 	pxor	%xmm$_, %xmm$_
 	ret
 .size	abi_test_clobber_xmm$_,.-abi_test_clobber_xmm$_
@@ -335,6 +338,7 @@
 abi_test_bad_unwind_wrong_register:
 .cfi_startproc
 .seh_startproc
+	_CET_ENDBR
 	pushq	%r12
 .cfi_push	%r13	# This should be %r13
 .seh_pushreg	%r13	# This should be %r13
@@ -358,6 +362,7 @@
 abi_test_bad_unwind_temporary:
 .cfi_startproc
 .seh_startproc
+	_CET_ENDBR
 	pushq	%r12
 .cfi_push	%r12
 .seh_pushreg	%r12
@@ -384,6 +389,7 @@
 .type	abi_test_set_direction_flag, \@abi-omnipotent
 .globl	abi_test_get_and_clear_direction_flag
 abi_test_get_and_clear_direction_flag:
+	_CET_ENDBR
 	pushfq
 	popq	%rax
 	andq	\$0x400, %rax
@@ -397,6 +403,7 @@
 .type	abi_test_set_direction_flag, \@abi-omnipotent
 .globl	abi_test_set_direction_flag
 abi_test_set_direction_flag:
+	_CET_ENDBR
 	std
 	ret
 .size abi_test_set_direction_flag,.-abi_test_set_direction_flag
diff --git a/include/openssl/asm_base.h b/include/openssl/asm_base.h
index 57a7d4a..f22a1a2 100644
--- a/include/openssl/asm_base.h
+++ b/include/openssl/asm_base.h
@@ -33,6 +33,9 @@
 //
 // - The file, on aarch64, uses the macros defined below to be compatible with
 //   BTI and PAC.
+//
+// - The file, on X86_64, requires the progrram to be compatible with Intel IBT
+//   and SHSTK
 
 #if defined(__ASSEMBLER__)
 
@@ -47,6 +50,22 @@
 .popsection
 #endif
 
+#if defined(__CET__) && defined(OPENSSL_X86_64)
+// Clang and GCC define __CET__ and provide <cet.h> when they support Intel's
+// Indirect Branch Tracking.
+// https://lpc.events/event/7/contributions/729/attachments/496/903/CET-LPC-2020.pdf
+//
+// cet.h defines _CET_ENDBR which is used to mark function entry points for IBT.
+// and adds the assembly marker. The value of _CET_ENDBR is made dependant on if
+// '-fcf-protection' is passed to the compiler. _CET_ENDBR is only required when
+// the function is the target of an indirect jump, but BoringSSL chooses to mark
+// all assembly entry points because it is easier, and allows BoringSSL's ABI
+// tester to call the assembly entry points via an indirect jump.
+#include <cet.h>
+#else
+#define _CET_ENDBR
+#endif
+
 #if defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)
 
 // We require the ARM assembler provide |__ARM_ARCH| from Arm C Language
diff --git a/third_party/fiat/asm/fiat_curve25519_adx_mul.S b/third_party/fiat/asm/fiat_curve25519_adx_mul.S
index dd7c225..b5d2aae 100644
--- a/third_party/fiat/asm/fiat_curve25519_adx_mul.S
+++ b/third_party/fiat/asm/fiat_curve25519_adx_mul.S
@@ -17,6 +17,7 @@
 #endif
 
 .cfi_startproc
+_CET_ENDBR
 mov [rsp - 0x08], rbp
 .cfi_offset rbp, -8-0x08
 mov rbp, rsp
diff --git a/third_party/fiat/asm/fiat_curve25519_adx_square.S b/third_party/fiat/asm/fiat_curve25519_adx_square.S
index 13fa8a8..0b876ab 100644
--- a/third_party/fiat/asm/fiat_curve25519_adx_square.S
+++ b/third_party/fiat/asm/fiat_curve25519_adx_square.S
@@ -17,6 +17,7 @@
 #endif
 
 .cfi_startproc
+_CET_ENDBR
 mov [rsp - 0x08], rbp
 .cfi_offset rbp, -8-0x08
 mov rbp, rsp