diff --git a/acinclude.m4 b/acinclude.m4
index a41a31ea..5b57c28e 100644
--- a/acinclude.m4
+++ b/acinclude.m4
@@ -499,7 +499,7 @@ AC_DEFUN([CURL_CC_DEBUG_OPTS],
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [restrict])
             CURL_ADD_COMPILER_WARNINGS([tmp_CFLAGS], [alloc-zero])
             tmp_CFLAGS="$tmp_CFLAGS -Wformat-overflow=2"
-            tmp_CFLAGS="$tmp_CFLAGS -Wformat-truncation=1"  # =2 causes false positives
+            tmp_CFLAGS="$tmp_CFLAGS -Wformat-truncation=2"
           fi
           #
           dnl Only gcc 10 or later
diff --git a/cmake/PickyWarnings.cmake b/cmake/PickyWarnings.cmake
index 97ffed74..4795c277 100644
--- a/cmake/PickyWarnings.cmake
+++ b/cmake/PickyWarnings.cmake
@@ -193,7 +193,7 @@ elseif(CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_GNUCXX OR CMAKE_C_COMPILER_I
           -Walloc-zero                     #             gcc  7.0
           -Wduplicated-branches            #             gcc  7.0
           -Wformat-overflow=2              #             gcc  7.0
-          -Wformat-truncation=1            #             gcc  7.0 (=2 causes false positives)
+          -Wformat-truncation=2            #             gcc  7.0
           -Wrestrict                       #             gcc  7.0
         )
       endif()
diff --git a/example/ssh2.c b/example/ssh2.c
index 08e2398f..513fdf6b 100644
--- a/example/ssh2.c
+++ b/example/ssh2.c
@@ -222,10 +222,18 @@ int main(int argc, char *argv[])
                 fprintf(stderr, "out of memory\n");
                 goto shutdown;
             }
+            /* Avoid false positives */
+#if defined(__GNUC__) && __GNUC__ >= 7
+#pragma GCC diagnostic push
+#pragma GCC diagnostic warning "-Wformat-truncation=1"
+#endif
             /* Using asprintf() here would be much cleaner,
                but less portable */
             snprintf(fn1, fn1sz, "%s/%s", h, pubkey);
             snprintf(fn2, fn2sz, "%s/%s", h, privkey);
+#if defined(__GNUC__) && __GNUC__ >= 7
+#pragma GCC diagnostic pop
+#endif
 
             if(libssh2_userauth_publickey_fromfile(session, username,
                                                    fn1, fn2,
diff --git a/tests/openssh_fixture.c b/tests/openssh_fixture.c
index e43a5d85..deafc293 100644
--- a/tests/openssh_fixture.c
+++ b/tests/openssh_fixture.c
@@ -85,7 +85,7 @@ static int run_command_varg(char **output, const char *command, va_list args)
 
     FILE *pipe;
     char command_buf[BUFSIZ];
-    char buf[BUFSIZ];
+    char buf[BUFSIZ + sizeof(redirect_stderr)];
     int ret;
     size_t buf_len;