diff --git a/infra/base-images/base-builder/indexer/manifest_types.py b/infra/base-images/base-builder/indexer/manifest_types.py
index 664d4dc01ee5..08fbb6118bcf 100644
--- a/infra/base-images/base-builder/indexer/manifest_types.py
+++ b/infra/base-images/base-builder/indexer/manifest_types.py
@@ -196,6 +196,10 @@ class CommandLineBinaryConfig(BinaryConfig):
   # are directly linked into the target binary. Should usually be true but
   # some targets like V8 require this to be false, see b/433718862.
   filter_compile_commands: bool = True
+  # Whether to enforce a strict flag allowlist for custom flags specified via
+  # `// Flags:` comments (when harness_kind is JS). Mostly needed for historic
+  # V8 builds that lack flag hardening (e.g. `--disallow-unsafe-flags`).
+  strict_flag_check: bool = False
 
   @property
   def uses_stdin(self) -> bool:
@@ -220,6 +224,7 @@ def from_dict(cls, config_dict: Mapping[str, Any]) -> Self:
         filter_compile_commands=config_dict.get(
             "filter_compile_commands", True
         ),
+        strict_flag_check=config_dict.get("strict_flag_check", False),
     )
 
 
diff --git a/projects/knot-dns/build.sh b/projects/knot-dns/build.sh
index e01593ebc46f..cd97d184722c 100755
--- a/projects/knot-dns/build.sh
+++ b/projects/knot-dns/build.sh
@@ -67,7 +67,7 @@ autoreconf -if
 make -j$(nproc)
 cd $SRC/knot-dns/tests-fuzz
 make check
-/bin/bash ../libtool   --mode=install /usr/bin/install -c fuzz_packet fuzz_zscanner fuzz_dname_to_str fuzz_dname_from_str "$OUT"
+/bin/bash ../libtool   --mode=install /usr/bin/install -c fuzz_packet fuzz_zscanner fuzz_dname_to_str fuzz_dname_from_str fuzz_dnssec_verify "$OUT"
 
 # Set up fuzzing seeds