diff --git a/tools/packaging/static-build/nvrc/Dockerfile b/tools/packaging/static-build/nvrc/Dockerfile
index 2e9421534c..1007bd4bc6 100644
--- a/tools/packaging/static-build/nvrc/Dockerfile
+++ b/tools/packaging/static-build/nvrc/Dockerfile
@@ -21,6 +21,7 @@ RUN apt-get update && \
 	curl \
 	binutils \
 	gcc \
+	libc6-dev \
 	git \
 	make \
 	musl-tools && \
diff --git a/tools/packaging/static-build/nvrc/build-static-nvrc.sh b/tools/packaging/static-build/nvrc/build-static-nvrc.sh
index 5fa5dc1eea..2338ca31a2 100755
--- a/tools/packaging/static-build/nvrc/build-static-nvrc.sh
+++ b/tools/packaging/static-build/nvrc/build-static-nvrc.sh
@@ -17,6 +17,15 @@ source "${script_dir}/../../scripts/lib.sh"
 [[ -n "${nvrc_repo}" ]] || die "failed to get nvrc repo"
 # shellcheck disable=SC2154
 [[ -n "${nvrc_ref}" ]] || die "failed to get nvrc git ref"
+# shellcheck disable=SC2154
+[[ -n "${nvrc_toolchain}" ]] || die "failed to get nvrc rust toolchain"
+
+# The NVRC checkout lives inside the kata-containers tree, whose root carries a
+# rust-toolchain.toml. rustup walks parent directories and would honour that pin
+# (a different channel than the one baked into this builder image, which is the
+# only toolchain with the musl target installed). Force our toolchain so the
+# build is decoupled from kata's root pin and the musl std is always found.
+export RUSTUP_TOOLCHAIN="${nvrc_toolchain}"
 
 [[ -d "nvrc" ]] && rm -rf nvrc
 
diff --git a/tools/packaging/static-build/nvrc/build.sh b/tools/packaging/static-build/nvrc/build.sh
index c38c3eb774..cc0411bfa3 100755
--- a/tools/packaging/static-build/nvrc/build.sh
+++ b/tools/packaging/static-build/nvrc/build.sh
@@ -46,6 +46,7 @@ docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \
 	--env DESTDIR="${DESTDIR}" \
 	--env nvrc_repo="${nvrc_repo}" \
 	--env nvrc_ref="${nvrc_ref}" \
+	--env nvrc_toolchain="${nvrc_toolchain}" \
 	--user "$(id -u)":"$(id -g)" \
 	"${container_image}" \
 	bash -c "${nvrc_builder}"