diff --git a/src/builder-context.c b/src/builder-context.c
index e185d7ca..d584687d 100644
--- a/src/builder-context.c
+++ b/src/builder-context.c
@@ -1183,19 +1183,35 @@ builder_context_load_sdk_config (BuilderContext   *self,
                                  const char       *sdk_path,
                                  GError          **error)
 {
-  g_autoptr(GFile) root = g_file_new_for_path (sdk_path);
-  g_autoptr(GFile) config_file = g_file_resolve_relative_path (root, "files/etc/flatpak-builder/defaults.json");
-  g_autoptr(GError) local_error = NULL;
+  glnx_autofd int root_dfd = -1;
+  glnx_autofd int fd = -1;
   g_autoptr(BuilderSdkConfig) sdk_config = NULL;
+  g_autoptr(GError) local_error = NULL;
 
-  sdk_config = builder_sdk_config_from_file (config_file, &local_error);
-  if (sdk_config == NULL &&
-      !g_error_matches (local_error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND))
+  if (!glnx_opendirat (AT_FDCWD, sdk_path, TRUE, &root_dfd, error))
+    return FALSE;
+
+  fd = glnx_chaseat (root_dfd,
+                     "files/etc/flatpak-builder/defaults.json",
+                     GLNX_CHASE_RESOLVE_BENEATH |
+                     GLNX_CHASE_MUST_BE_REGULAR,
+                     &local_error);
+  if (fd < 0)
     {
+      if (g_error_matches (local_error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND))
+        {
+          g_set_object (&self->sdk_config, NULL);
+          return TRUE;
+        }
+
       g_propagate_error (error, g_steal_pointer (&local_error));
       return FALSE;
     }
 
+  sdk_config = builder_sdk_config_from_fd (fd, error);
+  if (sdk_config == NULL)
+    return FALSE;
+
   g_set_object (&self->sdk_config, sdk_config);
   return TRUE;
 }
diff --git a/src/builder-sdk-config.c b/src/builder-sdk-config.c
index f99973d4..f5023fdb 100644
--- a/src/builder-sdk-config.c
+++ b/src/builder-sdk-config.c
@@ -19,6 +19,7 @@
  */
 
 #include "builder-sdk-config.h"
+#include "builder-utils.h"
 
 #include <json-glib/json-glib.h>
 
@@ -245,17 +246,20 @@ builder_sdk_config_get_rustflags (BuilderSdkConfig *self)
 }
 
 BuilderSdkConfig *
-builder_sdk_config_from_file (GFile    *file,
-                              GError  **error)
+builder_sdk_config_from_fd (int      fd,
+                            GError **error)
 {
-  g_autofree gchar     *config_contents = NULL;
-  gsize                 config_size;
+  g_autoptr(GBytes) bytes = NULL;
+  gsize size;
+  const char *data;
 
-  if (!g_file_load_contents (file, NULL, &config_contents, &config_size, NULL, error))
+  bytes = builder_read_fd (fd, FALSE, error);
+  if (bytes == NULL)
     return NULL;
 
-  return (BuilderSdkConfig*) json_gobject_from_data (BUILDER_TYPE_SDK_CONFIG,
-                                                     config_contents,
-                                                     config_size,
-                                                     error);
+  data = g_bytes_get_data (bytes, &size);
+  return (BuilderSdkConfig *) json_gobject_from_data (BUILDER_TYPE_SDK_CONFIG,
+                                                      data,
+                                                      size,
+                                                      error);
 }
diff --git a/src/builder-sdk-config.h b/src/builder-sdk-config.h
index c22505dc..44a962f2 100644
--- a/src/builder-sdk-config.h
+++ b/src/builder-sdk-config.h
@@ -40,7 +40,7 @@ const char *      builder_sdk_config_get_cxxflags (BuilderSdkConfig  *self);
 const char *      builder_sdk_config_get_ldflags  (BuilderSdkConfig  *self);
 const char *      builder_sdk_config_get_rustflags  (BuilderSdkConfig  *self);
 
-BuilderSdkConfig *builder_sdk_config_from_file    (GFile             *file,
+BuilderSdkConfig *builder_sdk_config_from_fd      (int                fd,
                                                    GError           **error);
 
 G_DEFINE_AUTOPTR_CLEANUP_FUNC (BuilderSdkConfig, g_object_unref)
diff --git a/src/builder-utils.c b/src/builder-utils.c
index 05be6616..e869692e 100644
--- a/src/builder-utils.c
+++ b/src/builder-utils.c
@@ -583,6 +583,40 @@ builder_gobject_from_data (GType       gtype,
   return json_gobject_deserialize (gtype, json);
 }
 
+GBytes *
+builder_read_fd (int       fd,
+                 gboolean  null_terminate,
+                 GError  **error)
+{
+  g_autoptr(GInputStream) stream = NULL;
+  glnx_autofd int rd_fd_owned = -1;
+  int rd_fd;
+  int fd_flags;
+
+  g_return_val_if_fail (fd >= 0, NULL);
+  g_return_val_if_fail (error == NULL || *error == NULL, NULL);
+
+  fd_flags = fcntl (fd, F_GETFL);
+  if (fd_flags < 0)
+    {
+      glnx_throw_errno_prefix (error, "fcntl(F_GETFL)");
+      return NULL;
+    }
+
+  if ((fd_flags & O_PATH) != 0 ||
+      (fd_flags & O_ACCMODE) == O_WRONLY)
+    rd_fd = rd_fd_owned = glnx_fd_reopen (fd, O_RDONLY, error);
+  else
+    rd_fd = fd;
+
+  if (rd_fd < 0)
+    return NULL;
+
+  stream = g_unix_input_stream_new (rd_fd, FALSE);
+
+  return flatpak_read_stream (stream, null_terminate, error);
+}
+
 char **
 builder_get_debuginfo_file_references (const char *filename, GError **error)
 {
diff --git a/src/builder-utils.h b/src/builder-utils.h
index 5e4a11d7..74e756a5 100644
--- a/src/builder-utils.h
+++ b/src/builder-utils.h
@@ -82,6 +82,10 @@ GObject * builder_gobject_from_data (GType       gtype,
                                      const char *contents,
                                      GError    **error);
 
+GBytes * builder_read_fd (int       fd,
+                          gboolean  null_terminate,
+                          GError  **error);
+
 gboolean builder_host_spawnv (GFile                *dir,
                               char                **output,
                               GSubprocessFlags      flags,
diff --git a/tests/libtest.sh b/tests/libtest.sh
index d6c36092..3537728d 100644
--- a/tests/libtest.sh
+++ b/tests/libtest.sh
@@ -252,13 +252,25 @@ make_updated_app () {
 
 setup_sdk_repo () {
     REPONAME=${1:-test}
+    SDK_ID=${2:-org.test.Sdk}
+
     if [ x${USE_COLLECTIONS_IN_SERVER-} == xyes ] ; then
-        COLLECTION_ID=${2:-org.test.Collection.${REPONAME}}
+        COLLECTION_ID=${3:-org.test.Collection.${REPONAME}}
     else
         COLLECTION_ID=""
     fi
 
-    GPGARGS="${GPGARGS:-${FL_GPGARGS}}" . $(dirname $0)/make-test-runtime.sh ${REPONAME} org.test.Sdk "${COLLECTION_ID}" bash ls cat echo readlink make mkdir cp touch > /dev/null
+    if [ "x${CREATE_SDK_CONFIG-}" = "x1" ]; then
+        create_sdk_config_arg=1
+    else
+        create_sdk_config_arg=
+    fi
+
+    GPGARGS="${GPGARGS:-${FL_GPGARGS}}" CREATE_SDK_CONFIG=${create_sdk_config_arg} \
+    . $(dirname $0)/make-test-runtime.sh \
+        ${REPONAME} ${SDK_ID} "${COLLECTION_ID}" \
+        bash ls cat echo readlink make mkdir cp touch > /dev/null
+
     update_repo $REPONAME "${COLLECTION_ID}"
 }
 
@@ -283,7 +295,8 @@ install_repo () {
 
 install_sdk_repo () {
     REPONAME=${1:-test}
-    ${FLATPAK} ${U} install -y ${REPONAME}-repo org.test.Sdk master >&2
+    SDK_ID=${2:-org.test.Sdk}
+    ${FLATPAK} ${U} install -y ${REPONAME}-repo ${SDK_ID} master >&2
 }
 
 install_python2_repo () {
diff --git a/tests/make-test-runtime.sh b/tests/make-test-runtime.sh
index 6ce48038..f1a076b1 100755
--- a/tests/make-test-runtime.sh
+++ b/tests/make-test-runtime.sh
@@ -21,6 +21,23 @@ cat > ${DIR}/metadata <<EOF
 name=${ID}
 EOF
 
+if [ "x${CREATE_SDK_CONFIG-}" = "x1" ]; then
+    mkdir -p "${DIR}/usr/etc/flatpak-builder"
+    cat > "${DIR}/usr/etc/flatpak-builder/defaults.json" <<EOF
+{
+  "libdir": "/usr/lib",
+  "cflags": "-O2 -g -fstack-protector-strong",
+  "cxxflags": "-O2 -g -fstack-protector-strong",
+  "cppflags": "",
+  "ldflags": "-Wl,-z,relro,-z,now",
+  "rustflags": "-C opt-level=2 -C debuginfo=2",
+  "cgo_cflags": "-O2 -g -fstack-protector-strong",
+  "cgo_cxxflags": "-O2 -g -fstack-protector-strong",
+  "cgo_ldflags": "-Wl,-z,relro,-z,now"
+}
+EOF
+fi
+
 # On Debian derivatives, /usr/sbin and /sbin aren't in ordinary users'
 # PATHs, but ldconfig is kept in /sbin
 PATH="$PATH:/usr/sbin:/sbin"
diff --git a/tests/test-builder-flags.sh b/tests/test-builder-flags.sh
index 2ff475ef..9690f07d 100755
--- a/tests/test-builder-flags.sh
+++ b/tests/test-builder-flags.sh
@@ -23,7 +23,7 @@ set -euo pipefail
 
 skip_without_fuse
 
-echo "1..7"
+echo "1..8"
 
 setup_repo
 install_repo
@@ -230,3 +230,44 @@ run_build test-rustflags-only-override.json
 assert_file_has_content appdir/files/rustflags_out '^unset$'
 
 echo "ok only rustflags-override clears rustflags"
+
+CREATE_SDK_CONFIG=1
+setup_repo testconfig
+setup_sdk_repo testconfig org.test.SdkConfig
+install_sdk_repo testconfig org.test.SdkConfig
+unset CREATE_SDK_CONFIG
+
+cat > test-sdk-config.json <<'EOF'
+{
+    "app-id": "org.test.SdkConfigApp",
+    "runtime": "org.test.Platform",
+    "sdk": "org.test.SdkConfig",
+    "modules": [{
+        "name": "test",
+        "buildsystem": "simple",
+        "build-commands": [
+            "echo $CFLAGS > /app/cflags",
+            "echo $CXXFLAGS > /app/cxxflags",
+            "echo $LDFLAGS > /app/ldflags",
+            "echo ${CPPFLAGS:-unset} > /app/cppflags",
+            "echo $RUSTFLAGS > /app/rustflags",
+            "echo $CGO_CFLAGS > /app/cgo_cflags",
+            "echo $CGO_CXXFLAGS > /app/cgo_cxxflags",
+            "echo $CGO_LDFLAGS > /app/cgo_ldflags"
+        ]
+    }]
+}
+EOF
+
+run_build test-sdk-config.json
+
+assert_file_has_content appdir/files/cflags '^\-O2 \-g \-fstack-protector-strong$'
+assert_file_has_content appdir/files/cxxflags '^\-O2 \-g \-fstack-protector-strong$'
+assert_file_has_content appdir/files/ldflags '^\-Wl,-z,relro,-z,now$'
+assert_file_has_content appdir/files/cppflags '^unset$'
+assert_file_has_content appdir/files/rustflags '^\-C opt-level=2 \-C debuginfo=2$'
+assert_file_has_content appdir/files/cgo_cflags '^\-O2 \-g \-fstack-protector-strong$'
+assert_file_has_content appdir/files/cgo_cxxflags '^\-O2 \-g \-fstack-protector-strong$'
+assert_file_has_content appdir/files/cgo_ldflags '^\-Wl,-z,relro,-z,now$'
+
+echo "ok sdk flags config from is loaded and flags are set correctly"