diff --git a/.gitattributes b/.gitattributes
index 8df340caef..e2a0641fbf 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -12,7 +12,6 @@
 .gitlab-ci.yml			 export-ignore
 .pylintrc			 export-ignore
 .readthedocs.yaml		 export-ignore
-.tsan-suppress			 export-ignore
 .uncrustify.cfg		 export-ignore
 dangerfile.py			 export-ignore
 /.github/**			 export-ignore
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index bf7afac45c..3b8e02c465 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -31,19 +31,9 @@ variables:
 
   CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls
 
-  UBASAN_CONFIGURE_FLAGS_COMMON: "-Db_sanitize=address,undefined -Didn=enabled -Djemalloc=disabled -Dtracing=disabled"
-  TSAN_CONFIGURE_FLAGS_COMMON: "-Db_sanitize=thread -Doptimization=2 -Ddebug=true -Didn=enabled -Dlocktype=system -Djemalloc=disabled --pkg-config-path /opt/tsan/lib/pkgconfig"
-
-  # Pass run-time flags to AddressSanitizer to get core dumps on error.
-  ASAN_OPTIONS: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1:detect_odr_violation=0
-  ASAN_SYMBOLIZER_PATH: "${LLVM_SYMBOLIZER}"
-
-  TSAN_OPTIONS_COMMON: "disable_coredump=0 second_deadlock_stack=1 atexit_sleep_ms=1000 history_size=7 log_exe_name=true log_path=tsan"
-  TSAN_SUPPRESSIONS: "suppressions=${CI_PROJECT_DIR}/.tsan-suppress"
-  TSAN_OPTIONS_DEBIAN: "${TSAN_OPTIONS_COMMON} ${TSAN_SUPPRESSIONS} external_symbolizer_path=${LLVM_SYMBOLIZER}"
-  TSAN_OPTIONS_FEDORA: "${TSAN_OPTIONS_COMMON} ${TSAN_SUPPRESSIONS} external_symbolizer_path=/usr/bin/llvm-symbolizer"
-
-  UBSAN_OPTIONS: "halt_on_error=1:abort_on_error=1:disable_coredump=0"
+  TSAN_CONFIGURE_FLAGS_COMMON: "-Db_sanitize=thread -Doptimization=2 -Ddebug=true -Didn=enabled -Dlocktype=system -Djemalloc=disabled -Dnamed-lto=disabled --pkg-config-path /opt/tsan/lib/pkgconfig"
+  TSAN_SYMBOLIZER_PATH_DEBIAN: "${LLVM_SYMBOLIZER}"
+  TSAN_SYMBOLIZER_PATH_FEDORA: "/usr/bin/llvm-symbolizer"
 
   WITHOUT_LIBEDIT: "-Dline=disabled"
   WITH_LIBEDIT: "-Dline=enabled"
@@ -449,6 +439,9 @@ stages:
     #- test -z "${CROSS_COMPILATION}" || grep -F -A 1 "checking whether we are cross compiling" config.log | grep -q "result.*yes"
     - test -z "${CROSS_COMPILATION}" || file build/lib/dns/gen | grep -F -q "ELF 64-bit LSB"
     #- test -z "${CROSS_COMPILATION}" || ( ! git ls-files -z --others --exclude lib/dns/gen | xargs -0 file | grep "ELF 64-bit LSB" )
+    - *find_python
+    # Check that embedded sanitizer flags are in sync with the `meson.build` file.
+    - $PYTHON ${CI_PROJECT_DIR}/ci/sanitizer_default_check.py build
     - build/named -V
     - *fips_feature_test
   needs: []
@@ -1572,8 +1565,6 @@ gcc:asan:
   <<: *build_job
 
 system:gcc:asan:
-  variables:
-    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
   <<: *fedora_43_amd64_image
   <<: *system_test_job
   needs:
@@ -1596,8 +1587,6 @@ clang:asan:
   <<: *build_job
 
 system:clang:asan:
-  variables:
-    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
   <<: *base_image
   <<: *system_test_job
   <<: *extra_system_tests_triggering_rules
@@ -1626,7 +1615,6 @@ gcc:tsan:
 
 system:gcc:tsan:
   variables:
-    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
   <<: *tsan_fedora_43_amd64_image
   <<: *system_test_tsan_job
   <<: *extra_system_tests_triggering_rules
@@ -1636,7 +1624,7 @@ system:gcc:tsan:
 
 unit:gcc:tsan:
   variables:
-    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
+    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_FEDORA}"
   <<: *tsan_fedora_43_amd64_image
   <<: *unit_test_tsan_job
   <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
@@ -1651,12 +1639,12 @@ clang:tsan:
     CC: "${CLANG}"
     CFLAGS: "${CFLAGS_COMMON}"
     LDFLAGS: "-Wl,--disable-new-dtags"
-    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false -Dnamed-lto=disabled --native-file ci/clang-trixie.ini"
+    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false --native-file ci/clang-trixie.ini"
   <<: *build_job
 
 system:clang:tsan:
   variables:
-    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
   <<: *tsan_debian_trixie_amd64_image
   <<: *system_test_tsan_job
   needs:
@@ -1665,7 +1653,7 @@ system:clang:tsan:
 
 unit:clang:tsan:
   variables:
-    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
   <<: *tsan_debian_trixie_amd64_image
   <<: *unit_test_tsan_job
   needs:
@@ -2278,9 +2266,9 @@ respdiff:tsan:
     CC: "${CLANG}"
     CFLAGS: "${CFLAGS_COMMON}"
     LDFLAGS: "-Wl,--disable-new-dtags"
-    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Dnamed-lto=disabled -Db_lundef=false"
+    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false"
     MAX_DISAGREEMENTS_PERCENTAGE: "0.3"
-    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
   script:
     - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
     - cd ../.. && ninja -C build clean >/dev/null 2>&1
diff --git a/.tsan-suppress b/.tsan-suppress
deleted file mode 100644
index c12884d27a..0000000000
--- a/.tsan-suppress
+++ /dev/null
@@ -1,9 +0,0 @@
-# Uninstrumented libraries
-called_from_lib:libfstrm.so
-race:dummyrpz
-
-# FreeBSD false-positive, see GL#5267
-race:libexec/rtld-elf/rtld_malloc.c
-
-# FreeBSD false-positive, see GL#5266
-deadlock:add_trace_entry
diff --git a/ci/sanitizer_default_check.py b/ci/sanitizer_default_check.py
new file mode 100755
index 0000000000..9a72a00387
--- /dev/null
+++ b/ci/sanitizer_default_check.py
@@ -0,0 +1,78 @@
+#!/usr/bin/env python
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+from pathlib import Path
+
+import argparse
+import json
+import subprocess
+import sys
+
+ASAN = False
+UBSAN = False
+TSAN = False
+
+args = argparse.ArgumentParser()
+args.add_argument("build")
+args = args.parse_args()
+
+build = Path(args.build)
+
+# https://mesonbuild.com/IDE-integration.html#build-options
+#
+# e.g. { "name": "b_sanitize", "value": ["address", "undefined"], ... }
+#
+with (build / "meson-info" / "intro-buildoptions.json").open() as f:
+    options = json.load(f)
+
+    for opt in options:
+        if opt["name"] == "b_sanitize":
+            ASAN = "address" in opt["value"]
+            UBSAN = "undefined" in opt["value"]
+            TSAN = "thread" in opt["value"]
+            break
+
+if not (ASAN or UBSAN or TSAN):
+    print("no sanitizer check necessary")
+    sys.exit(0)
+
+with (build / "meson-info" / "intro-targets.json").open() as f:
+    targets = json.load(f)
+
+    for target in targets:
+        if target["type"] == "executable" and Path(target["filename"][0]).exists():
+            nm = subprocess.run(
+                ["nm", target["filename"][0]],
+                stdin=None,
+                stdout=subprocess.PIPE,
+                timeout=1,
+                check=True,
+                shell=False,
+            )
+
+            if ASAN and b"__asan_default_options" not in nm.stdout:
+                print(f"Default ASAN options missing for executable '{target['name']}'")
+                sys.exit(1)
+
+            if UBSAN and b"__ubsan_default_options" not in nm.stdout:
+                print(
+                    f"Default UBSAN options missing for executable '{target['name']}'"
+                )
+                sys.exit(1)
+
+            if TSAN and b"__tsan_default_options" not in nm.stdout:
+                print(f"Default TSAN options missing for executable '{target['name']}'")
+                sys.exit(1)
+
+print("all relevant sanitizer defaults are set")
diff --git a/doc/misc/meson.build b/doc/misc/meson.build
index c27e129eb0..17c6b1a75a 100644
--- a/doc/misc/meson.build
+++ b/doc/misc/meson.build
@@ -15,6 +15,7 @@ cfg_test = executable(
     'cfg_test',
     files('cfg_test.c'),
     install: false,
+    sources: default_sanitize_options,
     dependencies: [
         libisc_dep,
         libisccfg_dep,
diff --git a/lib/dns/meson.build b/lib/dns/meson.build
index 96168d5e36..61b64bbfa4 100644
--- a/lib/dns/meson.build
+++ b/lib/dns/meson.build
@@ -23,6 +23,7 @@ dns_gen_headers = []
 dns_header_gen = executable(
     'gen',
     files('gen.c'),
+    sources: default_sanitize_options,
     install: false,
     native: true,
 )
diff --git a/meson.build b/meson.build
index 91d4924356..81e608cfbd 100644
--- a/meson.build
+++ b/meson.build
@@ -246,6 +246,22 @@ sys_defines = [
 
 add_project_arguments(sys_defines, language: 'c')
 
+### Sanitizer
+asan_options = 'abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1:detect_odr_violation=0'
+tsan_options = 'disable_coredump=0:second_deadlock_stack=1:atexit_sleep_ms=1000:history_size=7:log_exe_name=true:log_path=tsan'
+ubsan_options = 'halt_on_error=1:abort_on_error=1:disable_coredump=0'
+
+# Refer to sanitize.c.in for the justification
+config_sanitize = configuration_data()
+
+config_sanitize.set10('BIND_ASAN_ENABLED', 'address' in sanitizer)
+config_sanitize.set10('BIND_LSAN_ENABLED', 'leak' in sanitizer)
+config_sanitize.set10('BIND_TSAN_ENABLED', 'thread' in sanitizer)
+config_sanitize.set10('BIND_UBSAN_ENABLED', 'undefined' in sanitizer)
+config_sanitize.set('BIND_ASAN_OPTIONS', asan_options)
+config_sanitize.set('BIND_TSAN_OPTIONS', tsan_options)
+config_sanitize.set('BIND_UBSAN_OPTIONS', ubsan_options)
+
 ### Environment
 
 env = environment(
@@ -256,6 +272,15 @@ env = environment(
     },
 )
 
+# Meson defines these variables in unit tests when not set
+test_env = environment(
+    {
+        'ASAN_OPTIONS': asan_options,
+        'TSAN_OPTIONS': tsan_options,
+        'UBSAN_OPTIONS': ubsan_options,
+    },
+)
+
 ### Configuration
 config = configuration_data()
 
@@ -1093,6 +1118,12 @@ bind_keys = custom_target(
     ],
 )
 
+default_sanitize_options = configure_file(
+    input: files('sanitize.c.in'),
+    output: 'sanitize.c',
+    configuration: config_sanitize,
+)
+
 # Headers
 dns_inc = include_directories('lib' / 'dns' / 'include')
 isc_inc = include_directories('lib' / 'isc' / 'include')
@@ -1313,6 +1344,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libisc_dep,
     ],
@@ -1324,7 +1356,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: true,
     install: true,
-    sources: bind_keys,
+    sources: [bind_keys, default_sanitize_options],
     dependencies: [
         libisc_dep,
         libisccfg_dep,
@@ -1338,6 +1370,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1353,6 +1386,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1366,6 +1400,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1379,6 +1414,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1392,6 +1428,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1405,6 +1442,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1418,6 +1456,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1431,6 +1470,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1444,6 +1484,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1457,6 +1498,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1470,6 +1512,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1484,6 +1527,7 @@ if config.has('HAVE_DNSTAP')
         export_dynamic: true,
         implicit_include_directories: true,
         install: true,
+        sources: default_sanitize_options,
         dependencies: [
             libdns_dep,
             libisc_dep,
@@ -1499,6 +1543,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1514,6 +1559,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1527,7 +1573,7 @@ executable(
     implicit_include_directories: true,
     include_directories: [bin_inc],
     install: true,
-    sources: bind_keys,
+    sources: [bind_keys, default_sanitize_options],
     dependencies: [
         libisc_dep,
         libdns_dep,
@@ -1541,6 +1587,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libisc_dep,
         libdns_dep,
@@ -1561,6 +1608,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1573,6 +1621,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1585,6 +1634,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1599,6 +1649,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1653,7 +1704,7 @@ executable(
     include_directories: [named_inc, bin_inc],
     install: true,
     install_dir: sbindir,
-    sources: bind_keys,
+    sources: [bind_keys, default_sanitize_options],
     dependencies: named_deps
     + [
         openssl_dep,
@@ -1677,6 +1728,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1689,6 +1741,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1705,6 +1758,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1724,6 +1778,7 @@ executable(
     include_directories: confgen_inc_p,
     install: true,
     install_dir: sbindir,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1737,6 +1792,7 @@ executable(
     implicit_include_directories: false,
     install: true,
     install_dir: sbindir,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1753,6 +1809,7 @@ executable(
     include_directories: confgen_inc_p,
     install: true,
     install_dir: sbindir,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1823,6 +1880,7 @@ foreach name, sources : fuzz_binaries
         install: false,
         c_args: ['-Wno-vla'],
         link_args: fuzz_link_args,
+        sources: default_sanitize_options,
         dependencies: [
             libdns_dep,
             libisc_dep,
@@ -1847,6 +1905,7 @@ foreach name, sources : system_test_binaries
         export_dynamic: true,
         implicit_include_directories: false,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libdns_dep,
             libisc_dep,
diff --git a/sanitize.c.in b/sanitize.c.in
new file mode 100644
index 0000000000..8b5a9fcefe
--- /dev/null
+++ b/sanitize.c.in
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * We do not use `__SANITIZE_XXXX__` or `__has_feature` for the following
+ * reasons:
+ *
+ * - `__SANITIZE_UNDEFINED__` doesn't exist at all (currently GCC 15 & clang 21)
+ * - Other `__SANITIZE_XXXX__` macros don't exist in clang <23 [1]
+ * - `__has_feature` doesn't exist in GCC <14 [2]
+ *
+ * [1]: https://github.com/llvm/llvm-project/pull/153888
+ * [2]: https://gcc.gnu.org/gcc-14/changes.html#c-family
+ */
+
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wmissing-prototypes"
+
+#if @BIND_ASAN_ENABLED@
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__asan_default_options(void) {
+	return "@BIND_ASAN_OPTIONS@";
+}
+#endif
+
+/* ASAN will usually also enable LSAN */
+#if @BIND_ASAN_ENABLED@ || @BIND_LSAN_ENABLED@
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__lsan_default_suppressions(void) {
+    return
+        /* These are known leaks in libp11 */
+        "leak:BN_MONT_CTX_new\n"
+        "leak:C_LoadModule\n"
+        "leak:ctx_new\n"
+        "leak:ctx_try_load_object\n"
+        "leak:dlfcn_name_converter\n"
+        "leak:EC_GROUP_set_seed\n"
+        "leak:CRYPTO_strdup\n"
+        "leak:CRYPTO_zalloc\n"
+        "leak:pkcs11_check_token\n"
+        "leak:pkcs11_CTX_new\n"
+        "leak:pkcs11_enumerate_slots\n"
+        "leak:pkcs11_getattr_alloc\n"
+        "leak:pkcs11_init_key\n"
+        "leak:pkcs11_strdup\n"
+        "leak:xmlGetGlobalState\n"
+        "leak:xmlNewGlobalState\n"
+        "leak:__xmlDefaultBufferSize\n";
+}
+#endif
+
+#if @BIND_TSAN_ENABLED@
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__tsan_default_options(void) {
+	return "@BIND_TSAN_OPTIONS@";
+}
+
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__tsan_default_suppressions(void) {
+	return
+		/* Uninstrumented libraries */
+		"called_from_lib:libfstrm.so\n"
+		"race:dummyrpz\n"
+		/* FreeBSD false-positive, see GL#5267 */
+		"race:libexec/rtld-elf/rtld_malloc.c\n"
+		/* FreeBSD false-positive, see GL#5266 */
+		"deadlock:add_trace_entry";
+}
+#endif
+
+#if @BIND_UBSAN_ENABLED@
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__ubsan_default_options(void) {
+	return "@BIND_UBSAN_OPTIONS@";
+}
+#endif
+
+#pragma GCC diagnostic pop
diff --git a/suppr-lsan.txt b/suppr-lsan.txt
deleted file mode 100644
index ac08aa9a88..0000000000
--- a/suppr-lsan.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# These are known leaks in libp11.
-leak:BN_MONT_CTX_new
-leak:C_LoadModule
-leak:ctx_new
-leak:ctx_try_load_object
-leak:dlfcn_name_converter
-leak:EC_GROUP_set_seed
-leak:CRYPTO_strdup
-leak:CRYPTO_zalloc
-leak:pkcs11_check_token
-leak:pkcs11_CTX_new
-leak:pkcs11_enumerate_slots
-leak:pkcs11_getattr_alloc
-leak:pkcs11_init_key
-leak:pkcs11_strdup
-leak:xmlGetGlobalState
-leak:xmlNewGlobalState
-leak:__xmlDefaultBufferSize
diff --git a/tests/bench/meson.build b/tests/bench/meson.build
index b16b529ada..ec1bf9dee9 100644
--- a/tests/bench/meson.build
+++ b/tests/bench/meson.build
@@ -24,6 +24,7 @@ foreach bench : [
         files(fs.replace_suffix(bench, '.c')),
         export_dynamic: true,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libdns_dep,
@@ -42,6 +43,7 @@ executable(
     export_dynamic: true,
     include_directories: '..' / '..' / 'fuzz',
     install: false,
+    sources: default_sanitize_options,
     dependencies: [
         libisc_dep,
         libdns_dep,
diff --git a/tests/dns/meson.build b/tests/dns/meson.build
index 72b6754719..ba166f5a72 100644
--- a/tests/dns/meson.build
+++ b/tests/dns/meson.build
@@ -77,6 +77,7 @@ foreach unit : dns_tests
                 meson.project_source_root() / 'bin' / 'tests' / 'system' / 'geoip2' / 'data',
             ),
         ],
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libdns_dep,
@@ -95,6 +96,7 @@ foreach unit : dns_tests
         unit,
         test_bin,
         depends: master_data,
+        env: test_env,
         suite: ['dns', 'cmocka'],
         timeout: 300,
         workdir: meson.current_source_dir(),
diff --git a/tests/isc/meson.build b/tests/isc/meson.build
index 5aa7ecafee..0029ae6130 100644
--- a/tests/isc/meson.build
+++ b/tests/isc/meson.build
@@ -77,6 +77,7 @@ foreach unit : isc_test
         build_by_default: false,
         export_dynamic: true,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libtest_dep,
@@ -101,9 +102,9 @@ foreach unit : isc_test
     test(
         unit,
         test_bin,
+        env: test_env,
         suite: suites,
         timeout: timeout,
         workdir: meson.current_source_dir(),
-        env: env,
     )
 endforeach
diff --git a/tests/isccfg/meson.build b/tests/isccfg/meson.build
index ece606e0a0..0055f42f43 100644
--- a/tests/isccfg/meson.build
+++ b/tests/isccfg/meson.build
@@ -20,6 +20,7 @@ foreach unit : [
         build_by_default: false,
         export_dynamic: true,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libisccfg_dep,
@@ -32,6 +33,7 @@ foreach unit : [
     test(
         unit,
         test_bin,
+        env: test_env,
         suite: ['isccfg', 'cmocka'],
         timeout: 300,
         workdir: meson.current_source_dir(),
diff --git a/tests/ns/meson.build b/tests/ns/meson.build
index dc14986280..75c5260223 100644
--- a/tests/ns/meson.build
+++ b/tests/ns/meson.build
@@ -20,6 +20,7 @@ foreach unit : [
         build_by_default: false,
         export_dynamic: true,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libdns_dep,
@@ -36,6 +37,7 @@ foreach unit : [
     test(
         unit,
         test_bin,
+        env: test_env,
         suite: ['ns', 'cmocka'],
         timeout: 300,
         workdir: meson.current_source_dir(),