Index: src/asm/main.c
--- src/asm/main.c.orig
+++ src/asm/main.c
@@ -49,6 +49,8 @@
 char const *__asan_default_options(void) { return "detect_leaks=0"; }
 #endif
 
+int pledge(const char *, const char *);
+
 // Old Bison versions (confirmed for 2.3) do not forward-declare `yyparse` in the generated header
 // Unfortunately, macOS still ships 2.3, which is from 2008...
 int yyparse(void);
@@ -148,6 +150,8 @@ static void print_usage(void)
 
 int main(int argc, char *argv[])
 {
+	if (pledge("stdio rpath wpath cpath", NULL) == -1)
+		fatalerror("pledge");
 	time_t now = time(NULL);
 	char const *sourceDateEpoch = getenv("SOURCE_DATE_EPOCH");