diff --git a/Changelog b/Changelog
index d4a01245..2aea36b5 100644
--- a/Changelog
+++ b/Changelog
@@ -49,6 +49,8 @@
 	* PR #108: Fix for ldns-compare-zones net detecting when first zone
 	  has a RRset that shrinks from two to one RRs, or grows from one
 	  to two RRs. Thanks Emilio Caballero
+	* Fix #131: Drill sig chasing breaks with gcc-11 and
+	  strict-aliasing. Thanks Stanislav Levin
 
 1.7.1	2019-07-26
 	* bugfix: Manage verification paths for OpenSSL >= 1.1.0
diff --git a/configure.ac b/configure.ac
index 9980bf82..202c0983 100644
--- a/configure.ac
+++ b/configure.ac
@@ -97,6 +97,7 @@ ACX_CHECK_COMPILER_FLAG(Wstrict-prototypes, [CFLAGS="-Wstrict-prototypes $CFLAGS
 #ACX_CHECK_COMPILER_FLAG(Wshadow, [CFLAGS="-Wshadow $CFLAGS"])
 ACX_CHECK_COMPILER_FLAG(Wunused-function, [CFLAGS="-Wunused-function $CFLAGS"])
 ACX_CHECK_COMPILER_FLAG(Wmissing-prototypes, [CFLAGS="-Wmissing-prototypes $CFLAGS"])
+ACX_CHECK_COMPILER_FLAG(fno-strict-aliasing, [CFLAGS="-fno-strict-aliasing $CFLAGS"])
 
 AC_CHECK_HEADERS([getopt.h time.h],,, [AC_INCLUDES_DEFAULT])
 
diff --git a/sha2.c b/sha2.c
index f1004f02..8988ee06 100644
--- a/sha2.c
+++ b/sha2.c
@@ -554,7 +554,7 @@ typedef union _ldns_sha2_buffer_union {
         uint64_t* theLongs;
 } ldns_sha2_buffer_union;
 
-void ldns_sha256_final(sha2_byte digest[], ldns_sha256_CTX* context) {
+void ldns_sha256_final(sha2_byte digest[LDNS_SHA256_DIGEST_LENGTH], ldns_sha256_CTX* context) {
 	sha2_word32	*d = (sha2_word32*)digest;
 	size_t usedspace;
 	ldns_sha2_buffer_union cast_var;
@@ -905,7 +905,7 @@ static void ldns_sha512_Last(ldns_sha512_CTX* context) {
 	ldns_sha512_Transform(context, (sha2_word64*)context->buffer);
 }
 
-void ldns_sha512_final(sha2_byte digest[], ldns_sha512_CTX* context) {
+void ldns_sha512_final(sha2_byte digest[LDNS_SHA512_DIGEST_LENGTH], ldns_sha512_CTX* context) {
 	sha2_word64	*d = (sha2_word64*)digest;
 
 	/* Sanity check: */
@@ -958,7 +958,7 @@ void ldns_sha384_update(ldns_sha384_CTX* context, const sha2_byte* data, size_t
 	ldns_sha512_update((ldns_sha512_CTX*)context, data, len);
 }
 
-void ldns_sha384_final(sha2_byte digest[], ldns_sha384_CTX* context) {
+void ldns_sha384_final(sha2_byte digest[LDNS_SHA384_DIGEST_LENGTH], ldns_sha384_CTX* context) {
 	sha2_word64	*d = (sha2_word64*)digest;
 
 	/* Sanity check: */