diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml
index 4b1434c..c11e456 100644
--- a/.github/workflows/test-build.yml
+++ b/.github/workflows/test-build.yml
@@ -56,28 +56,24 @@ jobs:
         run: |
           mkdir -p build/amd64 build/arm64
 
-          # build amd64 binary
+          # build amd64 binary — static musl so no glibc floor on target systems
           sudo docker run --rm \
           -v "$(pwd)":/app \
           -w /app/backend \
-          -e CGO_ENABLED=1 \
-          -e GOOS=linux \
-          -e GOARCH=amd64 \
-          golang:1.25.10 \
-          go build -trimpath \
-          -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }}' \
-          -tags production -o ../build/amd64/phishingclub main.go
+          golang:1.25.10-alpine \
+          sh -c "apk add --no-cache gcc musl-dev && go build -trimpath \
+          -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }} -linkmode=external -extldflags=-static' \
+          -tags production -o ../build/amd64/phishingclub main.go"
 
-          # build arm64 binary
+          # build arm64 binary — run natively under QEMU (already set up above)
           sudo docker run --rm \
+          --platform linux/arm64 \
           -v "$(pwd)":/app \
           -w /app/backend \
-          -e CGO_ENABLED=1 \
-          -e GOOS=linux \
-          -e GOARCH=arm64 \
-          -e CC=aarch64-linux-gnu-gcc \
-          golang:1.25.10 \
-          bash -c "apt-get update && apt-get install -y gcc-aarch64-linux-gnu && go build -trimpath -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }}' -tags production -o ../build/arm64/phishingclub main.go"
+          golang:1.25.10-alpine \
+          sh -c "apk add --no-cache gcc musl-dev && go build -trimpath \
+          -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }} -linkmode=external -extldflags=-static' \
+          -tags production -o ../build/arm64/phishingclub main.go"
 
       - name: Fix build directory permissions
         run: |