diff --git a/.github/workflows/asan_unit_tests.yml b/.github/workflows/asan_unit_tests.yml
index 6c3dec8517..afccb4593f 100644
--- a/.github/workflows/asan_unit_tests.yml
+++ b/.github/workflows/asan_unit_tests.yml
@@ -15,6 +15,6 @@ jobs:
     - name: Run autotools / configure
       run: ./autogen.sh --enable-debug
     - name: Compile and link (make)
-      run: make -j8 CFLAGS="-Werror -Wall -fsanitize=address" LDFLAGS="-fsanitize=address"
+      run: make -j8 CFLAGS="-Werror -Wall -Wextra -Wno-sign-compare -fsanitize=address" LDFLAGS="-fsanitize=address"
     - name: Run unit tests
       run: make -C tests/unit CFLAGS="-fsanitize=address" LDFLAGS="-fsanitize=address" check
diff --git a/.github/workflows/macos_unit_tests.yml b/.github/workflows/macos_unit_tests.yml
index e781b39b0b..cb50d21da4 100644
--- a/.github/workflows/macos_unit_tests.yml
+++ b/.github/workflows/macos_unit_tests.yml
@@ -20,6 +20,6 @@ jobs:
       run: >
         ./autogen.sh --enable-debug
     - name: Compile and link
-      run: MACOSX_DEPLOYMENT_TARGET=15.4 make -j8 CFLAGS="-Werror -Wall"
+      run: MACOSX_DEPLOYMENT_TARGET=15.4 make -j8 CFLAGS="-Werror -Wall -Wextra -Wno-sign-compare"
     - name: Run unit tests
       run: make -C tests/unit check
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
index ad142ac402..0624f0b7e5 100644
--- a/.github/workflows/unit_tests.yml
+++ b/.github/workflows/unit_tests.yml
@@ -16,6 +16,6 @@ jobs:
     - name: Run autotools / configure
       run: ./autogen.sh --enable-debug
     - name: Compile and link (make)
-      run: make -j8 CFLAGS="-Werror -Wall"
+      run: make -j8 CFLAGS="-Werror -Wall -Wextra -Wno-sign-compare"
     - name: Run unit tests
       run: make -C tests/unit check
diff --git a/cf-serverd/server_tls.c b/cf-serverd/server_tls.c
index edc185237b..10f0794320 100644
--- a/cf-serverd/server_tls.c
+++ b/cf-serverd/server_tls.c
@@ -226,8 +226,8 @@ bool ServerTLSPeek(ConnectionInfo *conn_info)
 
     const int peek_size = CF_INBAND_OFFSET + sizeof("CAUTH");
 
-    char buf[peek_size];
-    ssize_t got = recv(ConnectionInfoSocket(conn_info), buf, sizeof(buf), MSG_PEEK);
+    char *buf = alloca(peek_size);
+    ssize_t got = recv(ConnectionInfoSocket(conn_info), buf, peek_size, MSG_PEEK);
     assert(got <= peek_size);
     if (got < 0)
     {
diff --git a/libntech b/libntech
index 944af926a7..9b43128e91 160000
--- a/libntech
+++ b/libntech
@@ -1 +1 @@
-Subproject commit 944af926a78c2410075419145510c4f4beb2901d
+Subproject commit 9b43128e91d002ff1a3ea8c46715ae7be79ddadf
diff --git a/libpromises/evalfunction.c b/libpromises/evalfunction.c
index 3ab5ad0251..51fb2a9c7c 100644
--- a/libpromises/evalfunction.c
+++ b/libpromises/evalfunction.c
@@ -8528,9 +8528,8 @@ static FnCallResult FnCallClassFilterCsv(EvalContext *ctx,
                 }
                 else
                 {
-                    size_t const key_len = PRINTSIZE(size_t);
-                    char key[key_len];
-                    xsnprintf(key, key_len, "%zu", i);
+                    char key[PRINTSIZE(size_t)];
+                    xsnprintf(key, PRINTSIZE(size_t), "%zu", i);
 
                     JsonObjectAppendString(class_container,
                                            key,
diff --git a/libpromises/ornaments.c b/libpromises/ornaments.c
index 469a6626a5..502137ea1a 100644
--- a/libpromises/ornaments.c
+++ b/libpromises/ornaments.c
@@ -170,7 +170,7 @@ void PromiseBanner(EvalContext *ctx, const Promise *pp)
     }
 
     const size_t n = 2*CF_MAXFRAGMENT + 3;
-    char pretty_promise_name[n+1];
+    char *pretty_promise_name = alloca(n+1);
     pretty_promise_name[0] = '\0';
     StringAppendAbbreviatedPromise(pretty_promise_name, pp->promiser, n, CF_MAXFRAGMENT);
     Log(LOG_LEVEL_VERBOSE, "P:    Promiser/affected object: '%s'", pretty_promise_name);
diff --git a/libpromises/syslog_client.c b/libpromises/syslog_client.c
index 0b68048c56..0b55a0cc91 100644
--- a/libpromises/syslog_client.c
+++ b/libpromises/syslog_client.c
@@ -27,6 +27,8 @@
 
 #include <cf3.defs.h>
 
+
+#define RFC3164_LENGTH 1024
 /*
  * Set by cf-agent/cf-serverd from body agent/server control.
  */
@@ -112,8 +114,7 @@ void RemoteSysLog(int log_priority, const char *log_string)
         }
         else
         {
-            const size_t rfc3164_len = 1024;
-            char message[rfc3164_len];
+            char message[RFC3164_LENGTH];
             char timebuffer[26];
             pid_t pid = getpid();
 
diff --git a/tests/acceptance/mock_package_manager.c b/tests/acceptance/mock_package_manager.c
index 70ac0d2cd8..dea326bad1 100644
--- a/tests/acceptance/mock_package_manager.c
+++ b/tests/acceptance/mock_package_manager.c
@@ -8,7 +8,7 @@
 static char AVAILABLE_PACKAGES_FILE_NAME[PATH_MAX];
 static char INSTALLED_PACKAGES_FILE_NAME[PATH_MAX];
 
-static const int MAX_PACKAGE_ENTRY_LENGTH = 256;
+#define MAX_PACKAGE_ENTRY_LENGTH 256
 
 #define DEFAULT_ARCHITECTURE "x666"