diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 66bdf57..2efa14a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,7 +40,7 @@ jobs:
       - name: Build pmm
         run: |
           mkdir -p out
-          ${{ matrix.cc }} -O2 -Wall -static -std=c11 -o out/pmm${{ matrix.ext }} \
+          ${{ matrix.cc }} -O2 -Wall -static -std=c11 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -o out/pmm${{ matrix.ext }} \
             src/main.c src/json.c src/ini.c src/pmm.c src/http.c src/repo.c src/install.c \
             src/sha256.c src/sha1.c src/mirrors.c src/pdm.c
 
diff --git a/src/pmm.c b/src/pmm.c
index 04ac0c7..226e668 100644
--- a/src/pmm.c
+++ b/src/pmm.c
@@ -362,7 +362,7 @@ void pmm_add_to_path(void) {
     }
 #endif
 
-    /* append missing dirs */
+    /* append missing dirs (bounds-safe: never let size_t underflow) */
     char next[17000] = "";
     snprintf(next, sizeof(next), "%s", cur);
     int added = 0;
@@ -370,8 +370,13 @@ void pmm_add_to_path(void) {
         if (!list[i][0]) continue;
         if (path_has(next, list[i], ';') || path_has(next, list[i], ':')) continue;
         size_t l = strlen(next);
-        if (l && next[l-1] != ';' && next[l-1] != ':') strncat(next, ";", sizeof(next)-l-1);
-        strncat(next, list[i], sizeof(next)-strlen(next)-1);
+        /* ensure a separator between entries */
+        if (l && next[l-1] != ';' && next[l-1] != ':' && l + 1 < sizeof(next)) {
+            next[l] = ';'; next[l+1] = '\0'; l++;
+        }
+        size_t room = sizeof(next) - l - 1;
+        if (room <= 0) break;                 /* no space left: stop */
+        snprintf(next + l, room + 1, "%s", list[i]);
         added++;
         printf("pmm: adding to PATH: %s\n", list[i]);
     }