diff --git a/third_party/bearssl/aes_x86ni.c b/third_party/bearssl/aes_x86ni.c
index d2fd25d0d..54c51efd7 100644
--- a/third_party/bearssl/aes_x86ni.c
+++ b/third_party/bearssl/aes_x86ni.c
@@ -205,7 +205,7 @@ x86ni_keysched(__m128i *sk, const void *key, size_t len)
 }
 
 /* see inner.h */
-BR_TARGET("sse2,aes")
+BR_TARGET("sse2,aes") BR_SSE_FUNCTION
 unsigned
 br_aes_x86ni_keysched_enc(unsigned char *skni, const void *key, size_t len)
 {
@@ -218,7 +218,7 @@ br_aes_x86ni_keysched_enc(unsigned char *skni, const void *key, size_t len)
 }
 
 /* see inner.h */
-BR_TARGET("sse2,aes")
+BR_TARGET("sse2,aes") BR_SSE_FUNCTION
 unsigned
 br_aes_x86ni_keysched_dec(unsigned char *skni, const void *key, size_t len)
 {
diff --git a/third_party/bearssl/aes_x86ni_cbcdec.c b/third_party/bearssl/aes_x86ni_cbcdec.c
index 862b1b5bd..903eb7916 100644
--- a/third_party/bearssl/aes_x86ni_cbcdec.c
+++ b/third_party/bearssl/aes_x86ni_cbcdec.c
@@ -46,7 +46,7 @@ br_aes_x86ni_cbcdec_init(br_aes_x86ni_cbcdec_keys *ctx,
 BR_TARGETS_X86_UP
 
 /* see bearssl_block.h */
-BR_TARGET("sse2,aes")
+BR_TARGET("sse2,aes") BR_SSE_FUNCTION
 void
 br_aes_x86ni_cbcdec_run(const br_aes_x86ni_cbcdec_keys *ctx,
 	void *iv, void *data, size_t len)
diff --git a/third_party/bearssl/aes_x86ni_cbcenc.c b/third_party/bearssl/aes_x86ni_cbcenc.c
index 85feecdb0..410ed36ee 100644
--- a/third_party/bearssl/aes_x86ni_cbcenc.c
+++ b/third_party/bearssl/aes_x86ni_cbcenc.c
@@ -46,7 +46,7 @@ br_aes_x86ni_cbcenc_init(br_aes_x86ni_cbcenc_keys *ctx,
 BR_TARGETS_X86_UP
 
 /* see bearssl_block.h */
-BR_TARGET("sse2,aes")
+BR_TARGET("sse2,aes") BR_SSE_FUNCTION
 void
 br_aes_x86ni_cbcenc_run(const br_aes_x86ni_cbcenc_keys *ctx,
 	void *iv, void *data, size_t len)
diff --git a/third_party/bearssl/aes_x86ni_ctr.c b/third_party/bearssl/aes_x86ni_ctr.c
index 42f1ed2b8..6223eb816 100644
--- a/third_party/bearssl/aes_x86ni_ctr.c
+++ b/third_party/bearssl/aes_x86ni_ctr.c
@@ -46,7 +46,7 @@ br_aes_x86ni_ctr_init(br_aes_x86ni_ctr_keys *ctx,
 BR_TARGETS_X86_UP
 
 /* see bearssl_block.h */
-BR_TARGET("sse2,sse4.1,aes")
+BR_TARGET("sse2,sse4.1,aes") BR_SSE_FUNCTION
 uint32_t
 br_aes_x86ni_ctr_run(const br_aes_x86ni_ctr_keys *ctx,
 	const void *iv, uint32_t cc, void *data, size_t len)
diff --git a/third_party/bearssl/aes_x86ni_ctrcbc.c b/third_party/bearssl/aes_x86ni_ctrcbc.c
index f57fead68..1f211da2f 100644
--- a/third_party/bearssl/aes_x86ni_ctrcbc.c
+++ b/third_party/bearssl/aes_x86ni_ctrcbc.c
@@ -46,7 +46,7 @@ br_aes_x86ni_ctrcbc_init(br_aes_x86ni_ctrcbc_keys *ctx,
 BR_TARGETS_X86_UP
 
 /* see bearssl_block.h */
-BR_TARGET("sse2,sse4.1,aes")
+BR_TARGET("sse2,sse4.1,aes") BR_SSE_FUNCTION
 void
 br_aes_x86ni_ctrcbc_ctr(const br_aes_x86ni_ctrcbc_keys *ctx,
 	void *ctr, void *data, size_t len)
@@ -252,7 +252,7 @@ br_aes_x86ni_ctrcbc_ctr(const br_aes_x86ni_ctrcbc_keys *ctx,
 }
 
 /* see bearssl_block.h */
-BR_TARGET("sse2,sse4.1,aes")
+BR_TARGET("sse2,sse4.1,aes") BR_SSE_FUNCTION
 void
 br_aes_x86ni_ctrcbc_mac(const br_aes_x86ni_ctrcbc_keys *ctx,
 	void *cbcmac, const void *data, size_t len)
@@ -303,7 +303,7 @@ br_aes_x86ni_ctrcbc_mac(const br_aes_x86ni_ctrcbc_keys *ctx,
 }
 
 /* see bearssl_block.h */
-BR_TARGET("sse2,sse4.1,aes")
+BR_TARGET("sse2,sse4.1,aes") BR_SSE_FUNCTION
 void
 br_aes_x86ni_ctrcbc_encrypt(const br_aes_x86ni_ctrcbc_keys *ctx,
 	void *ctr, void *cbcmac, void *data, size_t len)
@@ -452,7 +452,7 @@ br_aes_x86ni_ctrcbc_encrypt(const br_aes_x86ni_ctrcbc_keys *ctx,
 }
 
 /* see bearssl_block.h */
-BR_TARGET("sse2,sse4.1,aes")
+BR_TARGET("sse2,sse4.1,aes") BR_SSE_FUNCTION
 void
 br_aes_x86ni_ctrcbc_decrypt(const br_aes_x86ni_ctrcbc_keys *ctx,
 	void *ctr, void *cbcmac, void *data, size_t len)
diff --git a/third_party/bearssl/chacha20_sse2.c b/third_party/bearssl/chacha20_sse2.c
index 32d4f0d11..79e442af3 100644
--- a/third_party/bearssl/chacha20_sse2.c
+++ b/third_party/bearssl/chacha20_sse2.c
@@ -60,7 +60,7 @@ br_chacha20_sse2_get(void)
 BR_TARGETS_X86_UP
 
 /* see bearssl_block.h */
-BR_TARGET("sse2")
+BR_TARGET("sse2") BR_SSE_FUNCTION
 uint32_t
 br_chacha20_sse2_run(const void *key,
 	const void *iv, uint32_t cc, void *data, size_t len)
diff --git a/third_party/bearssl/ghash_pclmul.c b/third_party/bearssl/ghash_pclmul.c
index 81d61c25f..87da300d0 100644
--- a/third_party/bearssl/ghash_pclmul.c
+++ b/third_party/bearssl/ghash_pclmul.c
@@ -228,7 +228,7 @@ pclmulqdq11(__m128i x, __m128i y)
 	} while (0)
 
 /* see bearssl_hash.h */
-BR_TARGET("ssse3,pclmul")
+BR_TARGET("ssse3,pclmul") BR_SSE_FUNCTION
 void
 br_ghash_pclmul(void *y, const void *h, const void *data, size_t len)
 {
diff --git a/third_party/bearssl/inner.h b/third_party/bearssl/inner.h
index b0927daa1..40e059c3e 100644
--- a/third_party/bearssl/inner.h
+++ b/third_party/bearssl/inner.h
@@ -2400,6 +2400,18 @@ br_cpuid(uint32_t mask_eax, uint32_t mask_ebx,
 
 #endif
 
+/* BEG classicube specific */
+/* Fix issue where 32 bit GCC aligns stack to 4 bytes, but will still
+/*  generate instructions expecting the stack to be _16_ byte aligned */
+/* https://gcc.gnu.org/onlinedocs/gcc/x86-Function-Attributes.html */
+/* TODO is this needed for MSVC ? */
+#if (BR_GCC || BR_CLANG) && BR_i386 && !BR_amd64
+	#define BR_SSE_FUNCTION __attribute__((force_align_arg_pointer))
+#else
+	#define BR_SSE_FUNCTION
+#endif
+/* END classicube specific
+
 /* ==================================================================== */
 
 #endif