diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml
index ce298e5efe..9284bec988 100644
--- a/.github/workflows/build_test.yml
+++ b/.github/workflows/build_test.yml
@@ -26,7 +26,7 @@ jobs:
       matrix:
         env:
           - { COMPILER: "gcc",   COMPILER_VERSION: "11", LINKER: "bfd",  CRYPTOLIB: "gcrypt"  }
-          - { COMPILER: "gcc",   COMPILER_VERSION: "12", LINKER: "gold", CRYPTOLIB: "openssl" }
+          - { COMPILER: "gcc",   COMPILER_VERSION: "13", LINKER: "gold", CRYPTOLIB: "openssl" }
           - { COMPILER: "clang", COMPILER_VERSION: "14", LINKER: "mold", CRYPTOLIB: "gcrypt"  }
           - { COMPILER: "clang", COMPILER_VERSION: "15", LINKER: "lld",  CRYPTOLIB: "openssl" }
           - { COMPILER: "clang", COMPILER_VERSION: "16", LINKER: "bfd",  CRYPTOLIB: "auto"    }
diff --git a/meson.build b/meson.build
index 92b9a6ce5b..314cbcea89 100644
--- a/meson.build
+++ b/meson.build
@@ -376,6 +376,7 @@ possible_common_cc_flags = [
         '-Werror=return-type',
         '-Werror=shift-count-overflow',
         '-Werror=shift-overflow=2',
+        '-Werror=strict-flex-arrays',
         '-Werror=undef',
         '-Wfloat-equal',
         # gperf prevents us from enabling this because it does not emit fallthrough
diff --git a/src/boot/efi/proto/tcg.h b/src/boot/efi/proto/tcg.h
index af6989c854..d8802ae0e3 100644
--- a/src/boot/efi/proto/tcg.h
+++ b/src/boot/efi/proto/tcg.h
@@ -54,7 +54,7 @@ typedef struct {
                 uint8_t Digest[20];
         } Digest;
         uint32_t EventSize;
-        uint8_t Event[0];
+        uint8_t Event[];
 } _packed_ TCG_PCR_EVENT;
 
 typedef struct {
diff --git a/src/core/transaction.c b/src/core/transaction.c
index c3d6ffccc1..65a00bd928 100644
--- a/src/core/transaction.c
+++ b/src/core/transaction.c
@@ -325,6 +325,8 @@ static char* merge_unit_ids(const char* unit_log_field, char * const* pairs) {
         _cleanup_free_ char *ans = NULL;
         size_t size = 0;
 
+        assert(unit_log_field);
+
         STRV_FOREACH_PAIR(unit_id, job_type, pairs) {
                 size_t next;
 
diff --git a/src/shared/creds-util.c b/src/shared/creds-util.c
index 59f580775d..efc36e2d6d 100644
--- a/src/shared/creds-util.c
+++ b/src/shared/creds-util.c
@@ -342,6 +342,9 @@ int get_credential_host_secret(CredentialSecretFlags flags, void **ret, size_t *
                 filename = "credential.secret";
         }
 
+        assert(dirname);
+        assert(filename);
+
         mkdir_parents(dirname, 0755);
         dfd = open_mkdir_at(AT_FDCWD, dirname, O_CLOEXEC, 0755);
         if (dfd < 0)