diff --git a/.github/workflows/CI-unixish.yml b/.github/workflows/CI-unixish.yml
index 1087fcf6f6d..3ecb0693319 100644
--- a/.github/workflows/CI-unixish.yml
+++ b/.github/workflows/CI-unixish.yml
@@ -253,11 +253,11 @@ jobs:
       - name: Build with TEST_MATHLIB_VALUE
         run: |
           export PATH="/usr/lib/ccache:/usr/local/opt/ccache/libexec:$PATH"
-          make -j$(nproc) CPPFLAGS=-DTEST_MATHLIB_VALUE all
+          make -j$(nproc) CPPOPTS=-DTEST_MATHLIB_VALUE all
 
       - name: Test with TEST_MATHLIB_VALUE
         run: |
-          make -j$(nproc) CPPFLAGS=-DTEST_MATHLIB_VALUE check
+          make -j$(nproc) CPPOPTS=-DTEST_MATHLIB_VALUE check
 
   check_nonneg:
 
@@ -611,7 +611,7 @@ jobs:
         run: |
           export PATH="/usr/lib/ccache:/usr/local/opt/ccache/libexec:$PATH"
           # compile with verification and ast matchers
-          make -j$(nproc) -s CPPFLAGS="-DCHECK_INTERNAL" CXXOPTS="-g -O2 -w -DHAVE_BOOST" MATCHCOMPILER=yes VERIFY=1
+          make -j$(nproc) -s CXXOPTS="-g -O2 -w" CPPOPTS="-DCHECK_INTERNAL -DHAVE_BOOST" MATCHCOMPILER=yes VERIFY=1
 
       - name: CMake
         run: |
diff --git a/.github/workflows/selfcheck.yml b/.github/workflows/selfcheck.yml
index ddb1012bada..0e411239ec3 100644
--- a/.github/workflows/selfcheck.yml
+++ b/.github/workflows/selfcheck.yml
@@ -56,7 +56,7 @@ jobs:
           export PATH="/usr/lib/ccache:/usr/local/opt/ccache/libexec:$PATH"
           # valgrind cannot handle DWARF 5 yet so force version 4
           # work around performance regression with -inline-deferral
-          make -j$(nproc) -s CXXOPTS="-O2 -w -DHAVE_BOOST -gdwarf-4 -mllvm -inline-deferral" MATCHCOMPILER=yes
+          make -j$(nproc) -s CXXOPTS="-O2 -w -gdwarf-4" CPPOPTS="-DHAVE_BOOST -mllvm -inline-deferral" MATCHCOMPILER=yes
         env:
           CC: clang-14
           CXX: clang++-14
diff --git a/.github/workflows/valgrind.yml b/.github/workflows/valgrind.yml
index 04a5e0cef2a..6da798b0b58 100644
--- a/.github/workflows/valgrind.yml
+++ b/.github/workflows/valgrind.yml
@@ -41,12 +41,12 @@ jobs:
       - name: Build cppcheck
         run: |
           export PATH="/usr/lib/ccache:/usr/local/opt/ccache/libexec:$PATH"
-          CXXOPTS="-O1 -g -w -DHAVE_BOOST" make -j$(nproc) HAVE_RULES=yes MATCHCOMPILER=yes
+          CXXOPTS="-O1 -g -w" CPPOPTS="-DHAVE_BOOST" make -j$(nproc) HAVE_RULES=yes MATCHCOMPILER=yes
 
       - name: Build test
         run: |
           export PATH="/usr/lib/ccache:/usr/local/opt/ccache/libexec:$PATH"
-          CXXOPTS="-O1 -g -w -DHAVE_BOOST" make -j$(nproc) testrunner HAVE_RULES=yes MATCHCOMPILER=yes
+          CXXOPTS="-O1 -g -w" CPPOPTS="-DHAVE_BOOST" make -j$(nproc) testrunner HAVE_RULES=yes MATCHCOMPILER=yes
 
       - name: Run valgrind
         run: |
diff --git a/Makefile b/Makefile
index 95bc8e26a7c..98f2f4a6659 100644
--- a/Makefile
+++ b/Makefile
@@ -144,7 +144,8 @@ ifeq ($(HAVE_RULES),yes)
     ifeq ($(PCRE_CONFIG),)
         $(error Did not find pcre-config)
     endif
-    override CXXFLAGS += -DHAVE_RULES $(shell $(PCRE_CONFIG) --cflags)
+    override CXXFLAGS += $(shell $(PCRE_CONFIG) --cflags)
+    override CPPFLAGS += -DHAVE_RULES
     ifdef LIBS
         LIBS += $(shell $(PCRE_CONFIG) --libs)
     else
@@ -155,6 +156,7 @@ else ifneq ($(HAVE_RULES),)
 endif
 
 override CXXFLAGS += $(CXXOPTS)
+override CPPFLAGS += $(CPPOPTS)
 override LDFLAGS += $(LDOPTS)
 
 ifndef PREFIX
@@ -355,12 +357,12 @@ TESTOBJ =     test/fixture.o \
 ###### Targets
 
 cppcheck: $(EXTOBJ) $(LIBOBJ) $(FEOBJ) $(CLIOBJ)
-	$(CXX) $(CPPFLAGS) $(CXXFLAGS) -o $@ $^ $(LIBS) $(LDFLAGS) $(RDYNAMIC)
+	$(CXX) $(CXXFLAGS) -o $@ $^ $(LIBS) $(LDFLAGS) $(RDYNAMIC)
 
 all:	cppcheck testrunner
 
 testrunner: $(EXTOBJ) $(TESTOBJ) $(LIBOBJ) $(FEOBJ) cli/cmdlineparser.o cli/cppcheckexecutor.o cli/executor.o cli/filelister.o cli/processexecutor.o cli/sehwrapper.o cli/signalhandler.o cli/singleexecutor.o cli/stacktrace.o cli/threadexecutor.o
-	$(CXX) $(CPPFLAGS) $(CXXFLAGS) -o $@ $^ $(LIBS) $(LDFLAGS) $(RDYNAMIC)
+	$(CXX) $(CXXFLAGS) -o $@ $^ $(LIBS) $(LDFLAGS) $(RDYNAMIC)
 
 test:	all
 	./testrunner
diff --git a/oss-fuzz/Makefile b/oss-fuzz/Makefile
index b5a853f80ab..5d4658790aa 100644
--- a/oss-fuzz/Makefile
+++ b/oss-fuzz/Makefile
@@ -1,6 +1,6 @@
 # This file is generated by dmake, do not edit.
 
-# make CXX=clang++ MATCHCOMPILER=yes CXXFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -DHAVE_BOOST" LIB_FUZZING_ENGINE="-fsanitize=fuzzer" oss-fuzz-client
+# make CXX=clang++ MATCHCOMPILER=yes CXXOPTS="-O1 -fno-omit-frame-pointer -gline-tables-only -fsanitize=address -fsanitize-address-use-after-scope" CPPOPTS="-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -DHAVE_BOOST" LIB_FUZZING_ENGINE="-fsanitize=fuzzer" oss-fuzz-client
 
 MATCHCOMPILER=yes
 ifndef MATCHCOMPILER
@@ -31,7 +31,13 @@ else
 endif
 
 INCS=-I../lib -isystem../externals/simplecpp -isystem../externals/tinyxml2 -isystem../externals/picojson
-CPPFLAGS=-std=c++11 -g -w $(INCS)
+
+override CXXFLAGS+=-std=c++11 -g -w
+override CPPFLAGS+=$(INCS)
+
+override CXXFLAGS += $(CXXOPTS)
+override CPPFLAGS += $(CPPOPTS)
+override LDFLAGS += $(LDOPTS)
 
 LIBOBJ =      $(libcppdir)/valueflow.o \
               $(libcppdir)/tokenize.o \
@@ -106,10 +112,10 @@ EXTOBJ =      simplecpp.o \
               tinyxml2.o
 
 oss-fuzz-client: $(EXTOBJ) $(LIBOBJ) main.o type2.o
-	${CXX} $(CPPFLAGS) ${CXXFLAGS} -o $@ $^ ${LIB_FUZZING_ENGINE}
+	${CXX} ${CXXFLAGS} -o $@ $^ ${LIB_FUZZING_ENGINE}
 
 no-fuzz: $(EXTOBJ) $(LIBOBJ) main_nofuzz.o type2.o
-	${CXX} $(CPPFLAGS) ${CXXFLAGS} -o $@ $^
+	${CXX} ${CXXFLAGS} -o $@ $^
 
 translate: translate.o type2.o
 	${CXX} -std=c++11 -g ${CXXFLAGS} -o $@ type2.cpp translate.cpp
diff --git a/readme.md b/readme.md
index b397b3f3826..e98ff9e5645 100644
--- a/readme.md
+++ b/readme.md
@@ -184,12 +184,12 @@ Simple, unoptimized build (no dependencies):
 make
 ```
 
-You can use `CXXOPTS` and `LDOPTS` to append to the existing `CXXFLAGS` and `LDFLAGS` instead of overriding them.
+You can use `CXXOPTS`, `CPPOPTS` and `LDOPTS` to append to the existing `CXXFLAGS`, `CPPFLAGS` and `LDFLAGS` instead of overriding them.
 
 The recommended release build is:
 
 ```shell
-make MATCHCOMPILER=yes FILESDIR=/usr/share/cppcheck HAVE_RULES=yes CXXOPTS="-O2 -DNDEBUG"
+make MATCHCOMPILER=yes FILESDIR=/usr/share/cppcheck HAVE_RULES=yes CXXOPTS="-O2" CPPOPTS="-DNDEBUG"
 ```
 
 #### g++ (for experts)
@@ -211,8 +211,11 @@ g++ -o cppcheck -std=c++11 -Iexternals -Iexternals/simplecpp -Iexternals/tinyxml
 -  `HAVE_RULES=yes`
    Enables rules (requires PCRE to be installed).
 
--  `CXXOPTS="-O2 -DNDEBUG"`
-   Enables most compiler optimizations and disables assertions.
+-  `CXXOPTS="-O2"`
+   Enables most compiler optimizations.
+
+-  `CPPOPTS="-DNDEBUG"`
+   Disables assertions.
 
 -  `HAVE_BOOST=yes`
    Enables usage of more efficient container from Boost (requires Boost to be installed).
diff --git a/releasenotes.txt b/releasenotes.txt
index 9cdf8ceb1df..a632a93676b 100644
--- a/releasenotes.txt
+++ b/releasenotes.txt
@@ -18,4 +18,6 @@ Deprecations:
 Other:
 - Removed deprecated support for builds with Qt5.
 - Added make variables `CXXOPTS` and `LDOPTS` to extend existing `CXXFLAGS` and `LDFLAGS`.
+- Added make variables `CPPOPTS` to extend existing `CPPFLAGS`.
+- `CPPFLAGS` are not longer being passed to the linker command for `cppcheck` and `testrunner`.
 -
diff --git a/test/scripts/testrunner-single.sh b/test/scripts/testrunner-single.sh
index 2e449b0f430..3bb63a3c660 100755
--- a/test/scripts/testrunner-single.sh
+++ b/test/scripts/testrunner-single.sh
@@ -5,7 +5,7 @@ SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 if [ -n "$1" ]; then
   testrunner_bin=$1
 else
-  make -s -C "$SCRIPT_DIR/../.." -j"$(nproc)" testrunner # CXXOPTS="-g -O2 -w -DHAVE_BOOST"
+  make -s -C "$SCRIPT_DIR/../.." -j"$(nproc)" testrunner # CXXOPTS="-g -O2 -w" CPPOPTS="-DHAVE_BOOST"
   testrunner_bin=$SCRIPT_DIR/../../testrunner
 fi
 
diff --git a/tools/dmake/dmake.cpp b/tools/dmake/dmake.cpp
index f3b63d12e6e..541b216bb1b 100644
--- a/tools/dmake/dmake.cpp
+++ b/tools/dmake/dmake.cpp
@@ -351,23 +351,29 @@ static void write_ossfuzz_makefile(std::vector<std::string> libfiles_prio, std::
 
     fout << "# This file is generated by dmake, do not edit.\n";
     fout << '\n';
-    fout << "# make CXX=clang++ MATCHCOMPILER=yes CXXFLAGS=\"-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -DHAVE_BOOST\" LIB_FUZZING_ENGINE=\"-fsanitize=fuzzer\" oss-fuzz-client\n";
+    fout << "# make CXX=clang++ MATCHCOMPILER=yes CXXOPTS=\"-O1 -fno-omit-frame-pointer -gline-tables-only -fsanitize=address -fsanitize-address-use-after-scope\" CPPOPTS=\"-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -DHAVE_BOOST\" LIB_FUZZING_ENGINE=\"-fsanitize=fuzzer\" oss-fuzz-client\n";
     fout << '\n';
     fout << "MATCHCOMPILER=yes\n"; // always need to enable the matchcompiler so the library files are being copied
     makeMatchcompiler(fout, "../", "--read-dir ../lib");
 
     fout << "INCS=-I../lib -isystem../externals/simplecpp -isystem../externals/tinyxml2 -isystem../externals/picojson\n";
-    fout << "CPPFLAGS=-std=c++11 -g -w $(INCS)\n";
+    fout << '\n';
+    fout << "override CXXFLAGS+=-std=c++11 -g -w\n";
+    fout << "override CPPFLAGS+=$(INCS)\n";
+    fout << '\n';
+    fout << "override CXXFLAGS += $(CXXOPTS)\n";
+    fout << "override CPPFLAGS += $(CPPOPTS)\n";
+    fout << "override LDFLAGS += $(LDOPTS)\n";
     fout << '\n';
     fout << "LIBOBJ =      " << objfiles(libfiles_prio) << "\n";
     fout << '\n';
     fout << "EXTOBJ =      " << objfiles(extfiles) << "\n";
     fout << '\n';
     fout << "oss-fuzz-client: $(EXTOBJ) $(LIBOBJ) main.o type2.o\n";
-    fout << "\t${CXX} $(CPPFLAGS) ${CXXFLAGS} -o $@ $^ ${LIB_FUZZING_ENGINE}\n";
+    fout << "\t${CXX} ${CXXFLAGS} -o $@ $^ ${LIB_FUZZING_ENGINE}\n";
     fout << '\n';
     fout << "no-fuzz: $(EXTOBJ) $(LIBOBJ) main_nofuzz.o type2.o\n";
-    fout << "\t${CXX} $(CPPFLAGS) ${CXXFLAGS} -o $@ $^\n";
+    fout << "\t${CXX} ${CXXFLAGS} -o $@ $^\n";
     fout << '\n';
     fout << "translate: translate.o type2.o\n";
     fout << "\t${CXX} -std=c++11 -g ${CXXFLAGS} -o $@ type2.cpp translate.cpp\n";
@@ -708,7 +714,8 @@ int main(int argc, char **argv)
 
     // Makefile settings..
     if (release) {
-        makeConditionalVariable(fout, "CXXFLAGS", "-O2 -DNDEBUG -Wall -Wno-sign-compare -Wno-multichar");
+        makeConditionalVariable(fout, "CXXFLAGS", "-O2 -Wall -Wno-sign-compare -Wno-multichar");
+        fout << "override CPPFLAGS += -DNDEBUG\n\n";
     } else {
         makeConditionalVariable(fout, "CXXFLAGS",
                                 "-pedantic "
@@ -725,8 +732,8 @@ int main(int argc, char **argv)
                                 "-Wno-sign-compare "
                                 "-Wno-multichar "
                                 "-Woverloaded-virtual "
-                                //"$(CPPCHK_GLIBCXX_DEBUG) " // TODO: when using CXXOPTS this would always be set - need to handle this differently
                                 "-g");
+        //fout << "override CPPFLAGS += $(CPPCHK_GLIBCXX_DEBUG)\n\n"; // TODO: when using CXXOPTS this would always be set - need to handle this differently
     }
 
     fout << "ifeq (g++, $(findstring g++,$(CXX)))\n"
@@ -740,7 +747,8 @@ int main(int argc, char **argv)
          << "    ifeq ($(PCRE_CONFIG),)\n"
          << "        $(error Did not find pcre-config)\n"
          << "    endif\n"
-         << "    override CXXFLAGS += -DHAVE_RULES $(shell $(PCRE_CONFIG) --cflags)\n"
+         << "    override CXXFLAGS += $(shell $(PCRE_CONFIG) --cflags)\n"
+         << "    override CPPFLAGS += -DHAVE_RULES\n"
          << "    ifdef LIBS\n"
          << "        LIBS += $(shell $(PCRE_CONFIG) --libs)\n"
          << "    else\n"
@@ -751,6 +759,7 @@ int main(int argc, char **argv)
          << "endif\n\n";
 
     fout << "override CXXFLAGS += $(CXXOPTS)\n";
+    fout << "override CPPFLAGS += $(CPPOPTS)\n";
     fout << "override LDFLAGS += $(LDOPTS)\n\n";
 
     makeConditionalVariable(fout, "PREFIX", "/usr");
@@ -775,7 +784,7 @@ int main(int argc, char **argv)
     fout << ".PHONY: run-dmake tags\n\n";
     fout << "\n###### Targets\n\n";
     fout << "cppcheck: $(EXTOBJ) $(LIBOBJ) $(FEOBJ) $(CLIOBJ)\n";
-    fout << "\t$(CXX) $(CPPFLAGS) $(CXXFLAGS) -o $@ $^ $(LIBS) $(LDFLAGS) $(RDYNAMIC)\n\n";
+    fout << "\t$(CXX) $(CXXFLAGS) -o $@ $^ $(LIBS) $(LDFLAGS) $(RDYNAMIC)\n\n";
     fout << "all:\tcppcheck testrunner\n\n";
     std::string testrunner_clifiles_o;
     for (const std::string &clifile: clifiles) {
@@ -786,7 +795,7 @@ int main(int argc, char **argv)
         testrunner_clifiles_o += o;
     }
     fout << "testrunner: $(EXTOBJ) $(TESTOBJ) $(LIBOBJ) $(FEOBJ)" << testrunner_clifiles_o << "\n";
-    fout << "\t$(CXX) $(CPPFLAGS) $(CXXFLAGS) -o $@ $^ $(LIBS) $(LDFLAGS) $(RDYNAMIC)\n\n";
+    fout << "\t$(CXX) $(CXXFLAGS) -o $@ $^ $(LIBS) $(LDFLAGS) $(RDYNAMIC)\n\n";
     fout << "test:\tall\n";
     fout << "\t./testrunner\n\n";
     fout << "check:\tall\n";