diff --git a/CMakeLists.txt b/CMakeLists.txt
index 8cc9058d2..845d0f26f 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -112,9 +112,12 @@ endif()
 endif()
 
 # global compiler flags
+if(NOT WIN32)
+# MSYS2 needs -lssp and -fstack-protector for _FORTIFY_SOURCE
 add_compile_definitions(_FORTIFY_SOURCE=2)
-add_compile_options(-Wall -Wextra -W -Wshadow -Wformat -Wformat-security
-                    -fexceptions -fstrict-aliasing)
+add_compile_options(-Wformat -Werror=format-security)
+endif()
+add_compile_options(-Wall -Wextra -W -Wshadow -fexceptions -fstrict-aliasing)
 
 # don't use REQUIRED with subsequent find_package() operations; we use
 # feature_summary + set_package_properties to fail in one fell swoop.
@@ -423,7 +426,6 @@ target_link_libraries(notcurses++
   notcurses)
 
 set(NCPP_COMPILE_OPTIONS
-  -Werror=format-security
   -Wnull-dereference
   -Wunused
   -Wno-c99-extensions