Replace `nice clean' synchronous clock enable with a logic gate.
One logic gate serves a number of neighbouring flip-flops: state machine or broadside register.
Problem with AND gate: if CEN changes when clock is high: causes a glitch.
Problem with OR gate: if CEN changes when clock is low: causes a glitch.
Care needed to match clock skew when crossing to/from non-gated domain: avoid shoot-through by building out the non-gated parts as well.