How can one provide custom compiler/linker flags for OpenSSL?

I'm trying to build OpenSSL with -Wa,--noexecstack, but can't find anywhere in its config command-line to provide this flag. I've tried to set CFLAGS, but it appears to ignore that and just use its own.

This is an automated build working off a clean copy of the OpenSSL source, so a one-time hack of the config script isn't really an option.

Is there a way to pass custom flags to OpenSSL's build process?