diff --git a/.github/workflows/build-native.yml b/.github/workflows/build-native.yml
index 83e97ae9..012ce07e 100644
--- a/.github/workflows/build-native.yml
+++ b/.github/workflows/build-native.yml
@@ -37,6 +37,19 @@ jobs:
         run: make clean-native native-all
         env:
           OCI_EXE: docker
+      - name: Check Windows DLL security flags
+        run: |
+          # ASLR (DYNAMIC_BASE), DEP (NX_COMPAT), and 64-bit ASLR (HIGH_ENTROPY_VA) must be enabled (#288, #661)
+          check() {
+            flags=$(objdump -p "$1" | sed -n '/^DllCharacteristics/,/^[A-Z]/p')
+            echo "$1:"; echo "$flags"
+            for f in $2; do
+              echo "$flags" | grep -q "$f" || { echo "::error::$1 lacks $f"; exit 1; }
+            done
+          }
+          dir=src/main/resources/org/xerial/snappy/native/Windows
+          check $dir/x86/snappyjava.dll "DYNAMIC_BASE NX_COMPAT"
+          check $dir/x86_64/snappyjava.dll "DYNAMIC_BASE NX_COMPAT HIGH_ENTROPY_VA"
       - name: Create Pull Request
         if: ${{ github.event_name != 'pull_request' }}
         uses: peter-evans/create-pull-request@v8
diff --git a/Makefile.common b/Makefile.common
index 6c2ac3c1..e0c70114 100755
--- a/Makefile.common
+++ b/Makefile.common
@@ -289,14 +289,15 @@ FreeBSD-x86_64_SNAPPY_FLAGS :=
 Windows-x86_CXX          := $(CROSS_PREFIX)g++
 Windows-x86_STRIP        := $(CROSS_PREFIX)strip
 Windows-x86_CXXFLAGS     := -Ilib/inc_win -O2 -std=c++11
-Windows-x86_LINKFLAGS    := -Wl,--kill-at -shared -static
+# Enable ASLR (dynamicbase) and DEP (nxcompat)
+Windows-x86_LINKFLAGS    := -Wl,--kill-at -shared -static -Wl,--dynamicbase -Wl,--nxcompat
 Windows-x86_LIBNAME      := snappyjava.dll
 Windows-x86_SNAPPY_FLAGS :=
 
 Windows-x86_64_CXX          := $(CROSS_PREFIX)g++
 Windows-x86_64_STRIP        := $(CROSS_PREFIX)strip
 Windows-x86_64_CXXFLAGS     := -Ilib/inc_win -O2 -std=c++11
-Windows-x86_64_LINKFLAGS    := -Wl,--kill-at -shared -static
+Windows-x86_64_LINKFLAGS    := -Wl,--kill-at -shared -static -Wl,--dynamicbase -Wl,--nxcompat -Wl,--high-entropy-va
 Windows-x86_64_LIBNAME      := snappyjava.dll
 Windows-x86_64_SNAPPY_FLAGS :=
 
@@ -317,7 +318,7 @@ Linux-riscv64_SNAPPY_FLAGS:=
 Windows-aarch64_CXX       := $(CROSS_PREFIX)g++
 Windows-aarch64_STRIP     := $(CROSS_PREFIX)strip
 Windows-aarch64_CXXFLAGS  := -Ilib/inc_mac -I$(JAVA_HOME)/include -O2 -fPIC -march=armv8-a -fvisibility=hidden -D_WIN32 -DNOMINMAX -std=c++11
-Windows-aarch64_LINKFLAGS := -Wl,--kill-at -shared -static
+Windows-aarch64_LINKFLAGS := -Wl,--kill-at -shared -static -Wl,--dynamicbase -Wl,--nxcompat -Wl,--high-entropy-va
 Windows-aarch64_LIBNAME   := snappyjava.dll
 
 Linux-loongarch_CXX       := $(CROSS_PREFIX)g++