diff --git a/configure b/configure
index 65d6aa604..79144fc05 100755
--- a/configure
+++ b/configure
@@ -31216,7 +31216,7 @@ done
 exec_prefix="$oexec_prefix"
 
 if test X"$enable_intercept" != X"no"; then
-    SUDO_OBJS="${SUDO_OBJS} intercept.pb-c.lo"
+    SUDO_OBJS="${SUDO_OBJS} intercept.pb-c.o"
     PROGS="${PROGS} sudo_intercept.la"
     INSTALL_INTERCEPT="install-intercept"
 
diff --git a/configure.ac b/configure.ac
index f042f5f00..12d44de2f 100644
--- a/configure.ac
+++ b/configure.ac
@@ -4843,7 +4843,7 @@ dnl
 dnl Defer setting _PATH_SUDO_NOEXEC, etc until after exec_prefix is set
 dnl
 if test X"$enable_intercept" != X"no"; then
-    SUDO_OBJS="${SUDO_OBJS} intercept.pb-c.lo"
+    SUDO_OBJS="${SUDO_OBJS} intercept.pb-c.o"
     PROGS="${PROGS} sudo_intercept.la"
     INSTALL_INTERCEPT="install-intercept"
 
diff --git a/plugins/python/Makefile.in b/plugins/python/Makefile.in
index 640c96dd0..5d19baa03 100644
--- a/plugins/python/Makefile.in
+++ b/plugins/python/Makefile.in
@@ -132,7 +132,7 @@ VERSION = @PACKAGE_VERSION@
 
 TEST_PROGS = check_python_examples
 
-CHECK_PYTHON_EXAMPLES_OBJS = check_python_examples.o iohelpers.o testhelpers.o pyhelpers.lo sudo_python_debug.lo
+CHECK_PYTHON_EXAMPLES_OBJS = check_python_examples.o iohelpers.o testhelpers.o pyhelpers.o sudo_python_debug.o
 
 all: python_plugin.la
 
@@ -295,6 +295,13 @@ pyhelpers.i: $(srcdir)/pyhelpers.c $(incdir)/compat/stdbool.h \
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 pyhelpers.plog: pyhelpers.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/pyhelpers.c --i-file $< --output-file $@
+pyhelpers.o: $(srcdir)/pyhelpers.c $(incdir)/compat/stdbool.h \
+             $(incdir)/sudo_compat.h $(incdir)/sudo_debug.h \
+             $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
+             $(srcdir)/pyhelpers.h $(srcdir)/pyhelpers_cpychecker.h \
+             $(srcdir)/sudo_python_debug.h $(top_builddir)/config.h \
+             $(top_builddir)/pathnames.h
+	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/pyhelpers.c
 python_baseplugin.lo: $(srcdir)/python_baseplugin.c $(incdir)/compat/stdbool.h \
                       $(incdir)/sudo_compat.h $(incdir)/sudo_debug.h \
                       $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
@@ -499,6 +506,13 @@ sudo_python_debug.i: $(srcdir)/sudo_python_debug.c $(incdir)/compat/stdbool.h \
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 sudo_python_debug.plog: sudo_python_debug.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/sudo_python_debug.c --i-file $< --output-file $@
+sudo_python_debug.o: $(srcdir)/sudo_python_debug.c $(incdir)/compat/stdbool.h \
+                     $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h \
+                     $(incdir)/sudo_debug.h $(incdir)/sudo_fatal.h \
+                     $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \
+                     $(incdir)/sudo_queue.h $(srcdir)/sudo_python_debug.h \
+                     $(top_builddir)/config.h
+	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/sudo_python_debug.c
 sudo_python_module.lo: $(srcdir)/sudo_python_module.c \
                        $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
                        $(incdir)/sudo_debug.h $(incdir)/sudo_plugin.h \
diff --git a/scripts/mkdep.pl b/scripts/mkdep.pl
index abbc4a474..357f24f06 100755
--- a/scripts/mkdep.pl
+++ b/scripts/mkdep.pl
@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2011-2020 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2011-2021 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -111,7 +111,7 @@ sub mkdep {
     # Expand some configure bits
     $makefile =~ s:\@DEV\@::g;
     $makefile =~ s:\@COMMON_OBJS\@:aix.lo event_poll.lo event_select.lo:;
-    $makefile =~ s:\@SUDO_OBJS\@:intercept.pb-c.lo openbsd.o preload.o selinux.o sesh.o solaris.o:;
+    $makefile =~ s:\@SUDO_OBJS\@:intercept.pb-c.o openbsd.o preload.o selinux.o sesh.o solaris.o:;
     $makefile =~ s:\@SUDOERS_OBJS\@:bsm_audit.lo linux_audit.lo ldap.lo ldap_util.lo ldap_conf.lo solaris_audit.lo sssd.lo:;
     # XXX - fill in AUTH_OBJS from contents of the auth dir instead
     $makefile =~ s:\@AUTH_OBJS\@:afs.lo aix_auth.lo bsdauth.lo dce.lo fwtk.lo getspwuid.lo kerb5.lo pam.lo passwd.lo rfc1938.lo secureware.lo securid5.lo sia.lo:;
@@ -164,17 +164,29 @@ sub mkdep {
 	$old_deps{$1} = $2;
     }
 
+    # Check whether static objs are disabled for .lo files
+    my $disable_static;
+    if ($makefile =~ /LTFLAGS\s*=\s*(.+)$/m) {
+	my $ltflags = $1;
+	$_ = $implicit{"lo"};
+	if (defined($_)) {
+	    s/\$[\(\{]LTFLAGS[\)\}]/$ltflags/;
+	    $disable_static = /--tag=disable-static/;
+	}
+    }
+
     # Sort files so we do .lo files first
     foreach my $obj (sort keys %objs) {
 	next unless $obj =~ /(\S+)\.(l?o)$/;
-	if ($2 eq "o" && exists($objs{"$1.lo"})) {
+	if (!$disable_static && $2 eq "o" && exists($objs{"$1.lo"})) {
 	    # We have both .lo and .o files, only the .lo should be used
 	    warn "$file: $obj should be $1.lo\n";
 	} else {
 	    # Use old dependencies when mapping objects to their source.
 	    # If no old dependency, use the MANIFEST file to find the source.
-	    my $src = $1 . '.c';
+	    my $base = $1;
 	    my $ext = $2;
+	    my $src = $base . '.c';
 	    if (exists $old_deps{$obj}) {
 		$src = $old_deps{$obj};
 	    } elsif (exists $manifest{$src}) {
@@ -196,20 +208,22 @@ sub mkdep {
 	    $new_makefile .= $deps;
 	    $new_makefile .= "\t$imp\n";
 
-	    # PVS Studio files (.i and .plog)
-	    $imp = $implicit{"i"};
-	    if (exists $implicit{"i"} && exists $implicit{"plog"}) {
+	    # PVS Studio files (.i and .plog) but only do them once.
+	    if ($ext ne "o" || !exists($objs{"$base.lo"})) {
 		$imp = $implicit{"i"};
-		$deps =~ s/\.l?o/.i/;
-		$new_makefile .= $deps;
-		$new_makefile .= "\t$imp\n";
+		if (exists $implicit{"i"} && exists $implicit{"plog"}) {
+		    $imp = $implicit{"i"};
+		    $deps =~ s/\.l?o/.i/;
+		    $new_makefile .= $deps;
+		    $new_makefile .= "\t$imp\n";
 
-		$imp = $implicit{"plog"};
-		$imp =~ s/ifile=\$<; *//;
-		$imp =~ s/\$\$\{ifile\%i\}c/$src/;
-		$obj =~ /(.*)\.[a-z]+$/;
-		$new_makefile .= "${1}.plog: ${1}.i\n";
-		$new_makefile .= "\t$imp\n";
+		    $imp = $implicit{"plog"};
+		    $imp =~ s/ifile=\$<; *//;
+		    $imp =~ s/\$\$\{ifile\%i\}c/$src/;
+		    $obj =~ /(.*)\.[a-z]+$/;
+		    $new_makefile .= "${1}.plog: ${1}.i\n";
+		    $new_makefile .= "\t$imp\n";
+		}
 	    }
 	}
     }
diff --git a/src/Makefile.in b/src/Makefile.in
index c972447c4..7eb115e47 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -140,7 +140,7 @@ SHELL = @SHELL@
 PROGS = @PROGS@
 
 OBJS = conversation.o copy_file.o edit_open.o env_hooks.o exec.o exec_common.o \
-       exec_intercept.o exec_monitor.o exec_nopty.o exec_preload.lo exec_pty.o \
+       exec_intercept.o exec_monitor.o exec_nopty.o exec_preload.o exec_pty.o \
        get_pty.o hooks.o limits.o load_plugins.o net_ifs.o parse_args.o \
        preserve_fds.o signal.o sudo.o sudo_edit.o tcsetpgrp_nobg.o tgetpass.o \
        ttyname.o utmp.o @SUDO_OBJS@
@@ -149,14 +149,14 @@ IOBJS = $(OBJS:.o=.i) sesh.i
 
 POBJS = $(IOBJS:.i=.plog)
 
-SESH_OBJS = copy_file.o edit_open.o exec_common.o exec_preload.lo sesh.o
+SESH_OBJS = copy_file.o edit_open.o exec_common.o exec_preload.o sesh.o
 
 INTERCEPT_OBJS = exec_preload.lo sudo_intercept.lo sudo_intercept_common.lo \
 		 intercept.pb-c.lo
 
 CHECK_NET_IFS_OBJS = check_net_ifs.o net_ifs.o
 
-CHECK_NOEXEC_OBJS = check_noexec.o exec_common.o exec_preload.lo
+CHECK_NOEXEC_OBJS = check_noexec.o exec_common.o exec_preload.o
 
 CHECK_TTYNAME_OBJS = check_ttyname.o ttyname.o
 
@@ -596,6 +596,14 @@ exec_preload.i: $(srcdir)/exec_preload.c $(incdir)/compat/stdbool.h \
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 exec_preload.plog: exec_preload.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/exec_preload.c --i-file $< --output-file $@
+exec_preload.o: $(srcdir)/exec_preload.c $(incdir)/compat/stdbool.h \
+                $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h \
+                $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \
+                $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
+                $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
+                $(incdir)/sudo_util.h $(srcdir)/sudo.h $(srcdir)/sudo_exec.h \
+                $(top_builddir)/config.h $(top_builddir)/pathnames.h
+	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/exec_preload.c
 exec_pty.o: $(srcdir)/exec_pty.c $(incdir)/compat/stdbool.h \
             $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h \
             $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \
@@ -658,6 +666,9 @@ intercept.pb-c.i: $(srcdir)/intercept.pb-c.c $(incdir)/intercept.pb-c.h \
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 intercept.pb-c.plog: intercept.pb-c.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/intercept.pb-c.c --i-file $< --output-file $@
+intercept.pb-c.o: $(srcdir)/intercept.pb-c.c $(incdir)/intercept.pb-c.h \
+                  $(incdir)/protobuf-c/protobuf-c.h
+	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/intercept.pb-c.c
 limits.o: $(srcdir)/limits.c $(incdir)/compat/stdbool.h \
           $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \
           $(incdir)/sudo_event.h $(incdir)/sudo_fatal.h \