diff --git a/hack/update-bazel.sh b/hack/update-bazel.sh
index f126e41d919..5dcbc8c51cc 100755
--- a/hack/update-bazel.sh
+++ b/hack/update-bazel.sh
@@ -79,3 +79,10 @@ buildozer -quiet 'add tags manual' '//vendor/...:%go_binary' '//vendor/...:%go_t
 if [[ $ret != 0 && $ret != 3 ]]; then
   exit 1
 fi
+
+# we need to set this because gazelle doesn't support pkg-config, which would set this link option
+# see comment above re: buildozer exit codes
+buildozer -quiet 'set clinkopts select({"@io_bazel_rules_go//go/platform:linux":["-lseccomp",],"//conditions:default":[],})' //vendor/github.com/seccomp/libseccomp-golang:go_default_library && ret=$? || ret=$?
+if [[ $ret != 0 && $ret != 3 ]]; then
+  exit 1
+fi
diff --git a/vendor/github.com/seccomp/libseccomp-golang/BUILD b/vendor/github.com/seccomp/libseccomp-golang/BUILD
index db7b5309583..0a971ac0700 100644
--- a/vendor/github.com/seccomp/libseccomp-golang/BUILD
+++ b/vendor/github.com/seccomp/libseccomp-golang/BUILD
@@ -7,6 +7,7 @@ go_library(
         "seccomp_internal.go",
     ],
     cgo = True,
+    clinkopts = select({"@io_bazel_rules_go//go/platform:linux":["-lseccomp",],"//conditions:default":[],}),
     importmap = "k8s.io/kubernetes/vendor/github.com/seccomp/libseccomp-golang",
     importpath = "github.com/seccomp/libseccomp-golang",
     visibility = ["//visibility:public"],