diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go
index 5f5e8c7..1f2a20a 100644
--- a/ssl/test/runner/runner.go
+++ b/ssl/test/runner/runner.go
@@ -909,6 +909,17 @@
 	return exec.Command("xterm", xtermArgs...)
 }
 
+func removeFirstLineIfSuffix(s, suffix string) string {
+	idx := strings.IndexByte(s, '\n')
+	if idx < 0 {
+		return s
+	}
+	if strings.HasSuffix(s[:idx], suffix) {
+		return s[idx+1:]
+	}
+	return s
+}
+
 var (
 	errMoreMallocs   = errors.New("child process did not exhaust all allocation calls")
 	errUnimplemented = errors.New("child process does not implement needed flags")
@@ -1206,6 +1217,18 @@
 	stdout := strings.Replace(string(stdoutBuf.Bytes()), "\r\n", "\n", -1)
 	stderr := strings.Replace(string(stderrBuf.Bytes()), "\r\n", "\n", -1)
 
+	// Work around an NDK / Android bug. The NDK r16 sometimes generates
+	// binaries with the DF_1_PIE, which the runtime linker on Android N
+	// complains about. The next NDK revision should work around this but,
+	// in the meantime, strip its error out.
+	//
+	// https://github.com/android-ndk/ndk/issues/602
+	// https://android-review.googlesource.com/c/platform/bionic/+/259790
+	// https://android-review.googlesource.com/c/toolchain/binutils/+/571550
+	//
+	// Remove this after switching to the r17 NDK.
+	stderr = removeFirstLineIfSuffix(stderr, ": unsupported flags DT_FLAGS_1=0x8000001")
+
 	// Separate the errors from the shim and those from tools like
 	// AddressSanitizer.
 	var extraStderr string