diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 4fcd44d..88c193a 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -64,11 +64,15 @@ env:
   GITEA_HOST: gitea.whitlocktech.com
   REPO: RunicGateway/installer
   BIN: runicgateway-installer
-  LINUX_TARGET: x86_64-unknown-linux-gnu
+  # Both Linux binaries are STATIC (musl), D158. Linked against the runner's glibc
+  # they needed glibc 2.39 and would not start on Debian 12 or Ubuntu 22.04 — the
+  # hosts an operator is most likely to have (Rust phase 18 walk, step 7). The
+  # sidecar the installer deploys is already static for the same reason (D149).
+  LINUX_TARGET: x86_64-unknown-linux-musl
   WINDOWS_TARGET: x86_64-pc-windows-gnu
   # The installer has to run wherever the sidecar it installs can run, and link
   # publishes an arm64 Linux binary from v1.2.0 (PLAN.md §5.2, step 4 of 4).
-  ARM64_TARGET: aarch64-unknown-linux-gnu
+  ARM64_TARGET: aarch64-unknown-linux-musl
 
 jobs:
   release:
@@ -280,13 +284,14 @@ jobs:
           set -euo pipefail
           SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo"
           $SUDO apt-get update
-          # libc6-dev-arm64-cross is named explicitly on purpose: gcc-aarch64-linux-gnu only
-          # *recommends* it, and this install runs --no-install-recommends. Without it the Rust
-          # half of the arm64 build succeeds and then `ring` (under ureq's rustls) dies compiling
-          # C, on a missing bits/libc-header-start.h.
+          # `ring` (under ureq's rustls) compiles C, so each Linux target needs a C compiler that
+          # targets musl. Ubuntu packages one for x86_64 only; zig (via cargo-zigbuild) is one
+          # compiler for both, so both Linux builds go through it. python3-pip installs it;
+          # `file` is for the static-link check after the build.
           $SUDO apt-get install -y --no-install-recommends \
-            build-essential gcc-mingw-w64-x86-64 gcc-aarch64-linux-gnu libc6-dev-arm64-cross \
+            build-essential gcc-mingw-w64-x86-64 python3-pip file \
             curl ca-certificates git jq
+          pip3 install --quiet --break-system-packages ziglang cargo-zigbuild
 
           if ! command -v cargo >/dev/null 2>&1; then
             curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
@@ -295,6 +300,7 @@ jobs:
           echo "${HOME}/.cargo/bin" >> "$GITHUB_PATH"
           export PATH="${HOME}/.cargo/bin:${PATH}"
           rustup component add rustfmt
+          rustup target add "${LINUX_TARGET}"
           rustup target add "${WINDOWS_TARGET}"
           rustup target add "${ARM64_TARGET}"
 
@@ -322,9 +328,9 @@ jobs:
         run: cargo test --locked
 
       # ── RUST ADAPTER: build both targets ─────────────────────────────────
-      - name: cargo build --release (Linux)
+      - name: cargo build --release (Linux, static musl)
         if: ${{ steps.plan.outputs.release == 'true' }}
-        run: cargo build --release --locked --target "${LINUX_TARGET}"
+        run: cargo zigbuild --release --locked --target "${LINUX_TARGET}"
 
       - name: cargo build --release (Windows, cross via MinGW)
         if: ${{ steps.plan.outputs.release == 'true' }}
@@ -338,13 +344,9 @@ jobs:
       # arm64 Linux binary (PLAN.md §5.2). Without this step the target is installed and the
       # artifact is packaged, but nothing ever builds it — which is exactly how the first release
       # attempt failed, at `cp: cannot stat target/aarch64-unknown-linux-gnu/release/...`.
-      - name: cargo build --release (Linux arm64, cross)
+      - name: cargo build --release (Linux arm64, static musl)
         if: ${{ steps.plan.outputs.release == 'true' }}
-        env:
-          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
-          CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
-          AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
-        run: cargo build --release --locked --target "${ARM64_TARGET}"
+        run: cargo zigbuild --release --locked --target "${ARM64_TARGET}"
 
       # ── RUST ADAPTER: package artifacts (+ checksums) ────────────────────
       # SHA256SUMS is the trust anchor for these unsigned binaries (PLAN.md §3),
@@ -356,6 +358,13 @@ jobs:
           cp "target/${LINUX_TARGET}/release/${BIN}"        "dist/${BIN}-linux-x86_64"
           cp "target/${ARM64_TARGET}/release/${BIN}"        "dist/${BIN}-linux-aarch64"
           cp "target/${WINDOWS_TARGET}/release/${BIN}.exe"  "dist/${BIN}-windows-x86_64.exe"
+          # A "static" binary that is quietly dynamic fails only on the operator's host, on the
+          # first line, with a glibc version error — so it is refused here instead (D158).
+          for f in "dist/${BIN}-linux-x86_64" "dist/${BIN}-linux-aarch64"; do
+            if ! file "$f" | grep -q 'statically linked'; then
+              echo "::error::$f is not statically linked: $(file -b "$f")"; exit 1
+            fi
+          done
           # Every artifact must be listed: `sha256sum -c` passes silently over a
           # file the sums do not mention, and an operator verifying a download
           # would get a pass on a binary nobody vouched for.