diff --git a/sys/ssp/Makefile b/sys/ssp/Makefile
index 48422e909a47d..31d9c1ab708b3 100644
--- a/sys/ssp/Makefile
+++ b/sys/ssp/Makefile
@@ -1 +1,17 @@
+# module name is used below, thus set explicitly
+MODULE = ssp
+
+ifeq (,$(RIOT_CI_BUILD))
+  # random canary value newly generated on each build
+  CANARY := $(shell $(RIOTTOOLS)/randhex/randhex.py)
+else
+  # hardcoded canary value to not break CI test cache
+  CANARY := 0xdeadbeef
+endif
+
+# pass the generated canary using a macro and mark the object file using
+# it as PHONY to ensure that a new canary value is used on each build.
+CFLAGS += -DSTACK_CHK_GUARD=$(CANARY)U
+.PHONY: $(BINDIR)/$(MODULE)/$(MODULE).o
+
 include $(RIOTBASE)/Makefile.base
diff --git a/sys/ssp/ssp.c b/sys/ssp/ssp.c
index 2509a9a718900..e3039edba04da 100644
--- a/sys/ssp/ssp.c
+++ b/sys/ssp/ssp.c
@@ -22,9 +22,6 @@
 
 #include "panic.h"
 
-/* this should be randomized for each build */
-#define STACK_CHK_GUARD 0x595e9fbd94fda766
-
 uintptr_t __stack_chk_guard = (uintptr_t) STACK_CHK_GUARD;
 
 __attribute__((noreturn)) void __stack_chk_fail(void)