diff --git a/openEuler-rpm-config.spec b/openEuler-rpm-config.spec
index b18c9fd6015279a60ded2e640c601d88628846ed..072000abe6f5360ff0b642451dcd4e996a1da97d 100644
--- a/openEuler-rpm-config.spec
+++ b/openEuler-rpm-config.spec
@@ -3,7 +3,7 @@
 
 Name:		%{vendor}-rpm-config
 Version:	31
-Release:	16
+Release:	17
 License:	GPL+ AND MIT
 Summary:	specific rpm configuration files
 URL:		https://gitee.com/src-openeuler/openEuler-rpm-config
@@ -195,6 +195,9 @@ sed -i "s/@VENDOR@/%{vendor}/g" `grep "@VENDOR@" -rl %{buildroot}%{_rpmconfigdir
 %{_fileattrsdir}/kmod.attr
 
 %changelog
+* Tue Feb 18 2025 Jun He <jun.he@arm.com> - 31-17
+- Add compile flag (-mbranch-protection=standard) to enable PAC/BTI features on aarch64 as default
+
 * Mon Feb 03 2025 Funda Wang <fundawang@yeah.net> - 31-16
 - Make libfoo.so symlinks require the soname-provide of the target library
 - revert previous change regarding perl_default_filter, it causes regressions
diff --git a/rpmrc b/rpmrc
index 45840e66db4f48a76fe6a20b7e6d76564c0b635f..5f87e96002885f94631390cc87f93eb5a9fa3fb3 100644
--- a/rpmrc
+++ b/rpmrc
@@ -5,7 +5,7 @@ optflags: athlon %{__global_compiler_flags} -m32 -march=athlon -fasynchronous-un
 optflags: ia64 %{__global_compiler_flags}
 optflags: x86_64 %{__global_compiler_flags} -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection 
 
-optflags: aarch64 %{__global_compiler_flags} -fasynchronous-unwind-tables -fstack-clash-protection
+optflags: aarch64 %{__global_compiler_flags} -mbranch-protection=standard -fasynchronous-unwind-tables -fstack-clash-protection
 optflags: riscv64 %{__global_compiler_flags} -fasynchronous-unwind-tables -fstack-clash-protection
 
 optflags: loongarch64 %{__global_compiler_flags} -fasynchronous-unwind-tables -fstack-clash-protection