diff --git a/.github/workflows/wai-quantum-cli-release.yml b/.github/workflows/wai-quantum-cli-release.yml
index 017bae10c..439a12cab 100644
--- a/.github/workflows/wai-quantum-cli-release.yml
+++ b/.github/workflows/wai-quantum-cli-release.yml
@@ -121,7 +121,12 @@ jobs:
           t="${{ matrix.triple }}"
           T="$(echo "$t" | tr 'a-z-' 'A-Z_')"
           export "CC_${t//-/_}=musl-gcc" "CARGO_TARGET_${T}_LINKER=musl-gcc"
-          cargo build --locked --release --target "$t"
+          # Static, not static-pie: rustc asks the linker for -static-pie on musl,
+          # which this musl-gcc's specs do not take (it links a dynamic PIE against
+          # ld-musl instead); without position-independent code it asks for
+          # -static, which they do. RUSTFLAGS reach the target only, since
+          # --target is given, so build scripts build for the host as before.
+          RUSTFLAGS="-C target-feature=+crt-static -C relocation-model=static" cargo build --locked --release --target "$t"
           bin="target/$t/release/wai-quantum"
           if command -v file >/dev/null 2>&1; then
             file "$bin" | grep -q -E 'statically linked|static-pie linked' || { echo "::error::$bin is not static"; file "$bin"; exit 1; }