diff --git a/tools/packaging/kata-deploy/Dockerfile.components b/tools/packaging/kata-deploy/Dockerfile.components
index cc5c1e3a4f..89094c2288 100644
--- a/tools/packaging/kata-deploy/Dockerfile.components
+++ b/tools/packaging/kata-deploy/Dockerfile.components
@@ -7,6 +7,13 @@
 
 FROM alpine:3.22 AS nydus-binary-downloader
 
+# When STATIC_NYDUS_SNAPSHOTTER is set to a non-empty value, download the
+# statically linked release asset (nydus-snapshotter-<ver>-linux-static.tar.gz)
+# instead of the per-arch (dynamically, glibc-linked) one. The static binaries
+# run on musl-only hosts that have no glibc dynamic loader. The static asset is
+# currently published for x86_64/amd64 only.
+ARG STATIC_NYDUS_SNAPSHOTTER=""
+
 COPY versions.yaml /tmp/versions.yaml
 
 RUN \
@@ -18,9 +25,18 @@ RUN \
 	ARCH="$(uname -m)" && \
 	if [ "${ARCH}" = "x86_64" ]; then ARCH=amd64 ; fi && \
 	if [ "${ARCH}" = "aarch64" ]; then ARCH=arm64; fi && \
-	curl -fOL --progress-bar "${NYDUS_SNAPSHOTTER_REPO}/releases/download/${NYDUS_SNAPSHOTTER_VERSION}/nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz" && \
-	tar xvzpf "nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz" -C /opt/nydus-snapshotter && \
-	rm "nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz"
+	if [ -n "${STATIC_NYDUS_SNAPSHOTTER}" ]; then \
+		if [ "${ARCH}" != "amd64" ]; then \
+			echo "STATIC_NYDUS_SNAPSHOTTER is only supported on amd64 (no static asset is published for ${ARCH})" >&2; \
+			exit 1; \
+		fi; \
+		NYDUS_SNAPSHOTTER_TARBALL="nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-static.tar.gz"; \
+	else \
+		NYDUS_SNAPSHOTTER_TARBALL="nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz"; \
+	fi && \
+	curl -fOL --progress-bar "${NYDUS_SNAPSHOTTER_REPO}/releases/download/${NYDUS_SNAPSHOTTER_VERSION}/${NYDUS_SNAPSHOTTER_TARBALL}" && \
+	tar xvzpf "${NYDUS_SNAPSHOTTER_TARBALL}" -C /opt/nydus-snapshotter && \
+	rm "${NYDUS_SNAPSHOTTER_TARBALL}"
 
 #### Build binary package
 FROM ubuntu:22.04 AS rust-builder
diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-build-components-tarballs.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-build-components-tarballs.sh
index 720f47e013..73cb8b30b8 100755
--- a/tools/packaging/kata-deploy/local-build/kata-deploy-build-components-tarballs.sh
+++ b/tools/packaging/kata-deploy/local-build/kata-deploy-build-components-tarballs.sh
@@ -81,8 +81,15 @@ build_kata_deploy_job_dispatcher() {
 }
 
 build_nydus_snapshotter_for_coco_guest_pull() {
+	# STATIC_RUNTIME=yes is the umbrella flag for a musl-compatible payload: it
+	# builds the kata Go host binaries static (see static-build/shim-v2) and here
+	# pulls the statically linked nydus-snapshotter binaries instead of the
+	# glibc-linked per-arch ones.
+	local static_nydus_snapshotter="${STATIC_RUNTIME:-}"
+
 	docker buildx build \
 		--target nydus-binary-downloader \
+		--build-arg "STATIC_NYDUS_SNAPSHOTTER=${static_nydus_snapshotter}" \
 		--output "type=local,dest=${build_dir}/nydus-snapshotter-out" \
 		-f "${repo_root_dir}/tools/packaging/kata-deploy/Dockerfile.components" \
 		"${repo_root_dir}"