diff --git a/debian/patches/0008-link-only-as-needed.patch b/debian/patches/0008-link-only-as-needed.patch
new file mode 100644
index 0000000000000000000000000000000000000000..64c8380768612a3dfa1ffc61783049c12927fe60
--- /dev/null
+++ b/debian/patches/0008-link-only-as-needed.patch
@@ -0,0 +1,21 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Mon, 7 Jan 2019 16:43:41 -0500
+Subject: link only as needed
+
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index e96b6c2..610d25d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -13,7 +13,7 @@ check: hddemux
+ 	PATH=.:$$PATH ./testsuite
+ 
+ hddemux: hddemux.c
+-	gcc $(CPPFLAGS) $(CFLAGS) $< $(LDFLAGS) -std=c11 -pedantic -Wall -Werror -o $@
++	gcc $(CPPFLAGS) $(CFLAGS) $< -Wl,--as-needed $(LDFLAGS) -std=c11 -pedantic -Wall -Werror -o $@
+ 
+ hddemux.1: hddemux.1.md
+ 	pandoc -s -f markdown -t man -o $@ $<
diff --git a/debian/patches/series b/debian/patches/series
index 3947e24d18f997a62167cf891d2d9fa6ab7b666d..7bcea9e245761e6354b65ccddb7b89ee15b9a9d6 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -5,3 +5,4 @@
 0005-testsuite-handle-other-nginx-temp_path-vars.patch
 0006-testsuite-send-expected-stderr-to-stdout.patch
 0007-testsuite-Unset-https_proxy-and-http_proxy.patch
+0008-link-only-as-needed.patch