diff --git a/Makefile.PL b/Makefile.PL
index db5ddb5..dde27d9 100644
--- a/Makefile.PL
+++ b/Makefile.PL
@@ -230,6 +230,11 @@ my @CC_DEFINE = (
 	'-DNDEBUG=1',
 );
 
+# for upstream security concern, this should be set only if requested
+if ($ENV{SQLITE_ENABLE_FTS3_TOKENIZER}) {
+	push @CC_DEFINE, '-DSQLITE_ENABLE_FTS3_TOKENIZER'; # for sqlite >= 3.11.0
+}
+
 if (DEVELOPER_ONLY) {
 	# for sqlite >= 3.8.8
 	push @CC_DEFINE, '-DSQLITE_ENABLE_API_ARMOR';