diff --git a/configure.ac b/configure.ac
index 59255e45f..cd54054d9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -334,6 +334,7 @@ ARG_ENABL_SET([leak-detective], [enable malloc hooks to find memory leaks.])
 ARG_ENABL_SET([lock-profiler],  [enable lock/mutex profiling code.])
 ARG_ENABL_SET([log-thread-ids], [use thread ID, if available, instead of an incremented value starting from 1, to identify threads.])
 ARG_ENABL_SET([monolithic],     [build monolithic version of libstrongswan that includes all enabled plugins. Similarly, the plugins of charon are assembled in libcharon.])
+ARG_ENABL_SET([warnings],       [enable extended compiler warnings and -Werror (auto-enabled when building from the repository).])
 
 # ===================================
 #  option to disable default options
@@ -366,7 +367,7 @@ fi
 # ===========================
 
 if test -z "$CFLAGS"; then
-	CFLAGS="-g -O2 -Wall -Wno-format -Wno-format-security -Wno-pointer-sign"
+	CFLAGS="-g -O2"
 fi
 AC_SUBST(PLUGIN_CFLAGS)
 AC_PROG_CC
@@ -529,6 +530,12 @@ if test x$kdf = xfalse; then
 	fi
 fi
 
+# enable warnings and -Werror by default when building from the repo (check with
+# -e as .git is a file in worktrees)
+if test x$warnings_given = xfalse -a -e "$srcdir"/.git; then
+	warnings=true
+fi
+
 # ===========================================
 #  check required libraries and header files
 # ===========================================
@@ -1322,8 +1329,6 @@ if test x$dev_headers = xyes; then
 fi
 AC_SUBST(dev_headers)
 
-CFLAGS="$CFLAGS -include `pwd`/config.h"
-
 if test x$tkm = xtrue; then
 	AC_PATH_PROG([GPRBUILD], [gprbuild], [], [$PATH:/bin:/usr/bin:/usr/local/bin])
 	if test x$GPRBUILD = x; then
@@ -1441,6 +1446,32 @@ if test x$git_version = xtrue -a "$GIT_VERSION" != "UNKNOWN"; then
 	AC_DEFINE_UNQUOTED(VERSION, ["$GIT_VERSION"])
 fi
 
+# modify CFLAGS as needed, do this late so we don't affect configure checks
+CFLAGS="$CFLAGS -include $(pwd)/config.h"
+
+WARN_CFLAGS=
+if test x$warnings = xtrue; then
+	WARN_CFLAGS="-Werror -Wall -Wextra"
+fi
+# disable some warnings, whether explicitly enabled above or by default
+# these are not compatible with our custom printf specifiers
+WARN_CFLAGS="$WARN_CFLAGS -Wno-format"
+WARN_CFLAGS="$WARN_CFLAGS -Wno-format-security"
+# we generally use comments, but GCC doesn't seem to recognize many of them
+WARN_CFLAGS="$WARN_CFLAGS -Wno-implicit-fallthrough"
+# we often omit fields when initializing structs (e.g. when using INIT)
+WARN_CFLAGS="$WARN_CFLAGS -Wno-missing-field-initializers"
+# allow assigning char* to u_char* (e.g. in chunk_create())
+WARN_CFLAGS="$WARN_CFLAGS -Wno-pointer-sign"
+# allow comparing e.g. int with chunk_t::len or countof(...)
+WARN_CFLAGS="$WARN_CFLAGS -Wno-sign-compare"
+# allow defensive checks like e.g. unsigned_var < CONST(= currently 0)
+WARN_CFLAGS="$WARN_CFLAGS -Wno-type-limits"
+# we often don't use function parameters when implementing interfaces
+WARN_CFLAGS="$WARN_CFLAGS -Wno-unused-parameter"
+# add the flags before existing CFLAGS so warning flags can be overridden
+CFLAGS="$WARN_CFLAGS $CFLAGS"
+
 # ===============================================
 #  collect plugin list for strongSwan components
 # ===============================================
diff --git a/scripts/git-version b/scripts/git-version
index 86e413c0e..bf8ce695e 100755
--- a/scripts/git-version
+++ b/scripts/git-version
@@ -5,7 +5,7 @@ TARBALL=$SRCDIR/.tarball-git-version
 
 if test -f $TARBALL; then
 	V=$(cat $TARBALL)
-elif test -d $SRCDIR/.git; then
+elif test -e $SRCDIR/.git; then
 	V=$(git -C $SRCDIR describe --exclude 'android-*' --tags HEAD 2>/dev/null)
 fi
 
diff --git a/scripts/test.sh b/scripts/test.sh
index 589199cc4..bc10785e8 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -143,7 +143,7 @@ TARGET=check
 
 DEPS="libgmp-dev"
 
-CFLAGS="-g -O2 -Wall -Wno-format -Wno-format-security -Wno-pointer-sign -Werror"
+CFLAGS="-g -O2"
 
 case "$TEST" in
 default)