diff --git a/config/ChangeLog b/config/ChangeLog
index 6732bf4f73f..2e3ead0a26b 100644
--- a/config/ChangeLog
+++ b/config/ChangeLog
@@ -1,3 +1,7 @@
+2017-10-24  H.J. Lu  <hongjiu.lu@intel.com>
+
+	* bootstrap-cet.mk: New file.
+
 2017-06-19  Martin Liska  <mliska@suse.cz>
 
 	* bootstrap-lto-noplugin.mk: Enable -flto in all PGO stages.
diff --git a/config/bootstrap-cet.mk b/config/bootstrap-cet.mk
new file mode 100644
index 00000000000..f09193a6dea
--- /dev/null
+++ b/config/bootstrap-cet.mk
@@ -0,0 +1,4 @@
+# This option enables -fcf-protection -mcet for stage2 and stage3.
+
+STAGE2_CFLAGS += -fcf-protection -mcet
+STAGE3_CFLAGS += -fcf-protection -mcet
diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 5a43ff890be..ce02caa6d24 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,7 @@
+2017-10-24  H.J. Lu  <hongjiu.lu@intel.com>
+
+	* doc/install.texi: Document bootstrap-cet.
+
 2017-10-24  H.J. Lu  <hongjiu.lu@intel.com>
 
 	PR target/82659
diff --git a/gcc/doc/install.texi b/gcc/doc/install.texi
index da360da1c50..82a63607b2d 100644
--- a/gcc/doc/install.texi
+++ b/gcc/doc/install.texi
@@ -2492,6 +2492,13 @@ useful to verify the full @option{-fcompare-debug} testing coverage.  It
 must be used along with @code{bootstrap-debug-lean} and
 @code{bootstrap-debug-lib}.
 
+@item @samp{bootstrap-cet}
+This option enables Intel CET for host tools during bootstrapping.
+@samp{BUILD_CONFIG=bootstrap-cet} is equivalent to adding
+@option{-fcf-protection -mcet} to @samp{BOOT_CFLAGS}.  This option
+assumes that the host supports Intel CET (e.g. GNU assembler version
+2.30 or later).
+
 @item @samp{bootstrap-time}
 Arranges for the run time of each program started by the GCC driver,
 built in any stage, to be logged to @file{time.log}, in the top level of