diff --git a/hack/lib/golang.sh b/hack/lib/golang.sh
index 9f229168a8a..88e0a8f6520 100755
--- a/hack/lib/golang.sh
+++ b/hack/lib/golang.sh
@@ -213,12 +213,24 @@ readonly KUBE_STATIC_LIBRARIES=(
   kubectl
 )
 
+# KUBE_CGO_OVERRIDES is a space-separated list of binaries which should be built
+# with CGO enabled, assuming CGO is supported on the target platform.
+# This overrides any entry in KUBE_STATIC_LIBRARIES.
+IFS=" " read -ra KUBE_CGO_OVERRIDES <<< "${KUBE_CGO_OVERRIDES:-}"
+readonly KUBE_CGO_OVERRIDES
+# KUBE_STATIC_OVERRIDES is a space-separated list of binaries which should be
+# built with CGO disabled. This is in addition to the list in
+# KUBE_STATIC_LIBRARIES.
+IFS=" " read -ra KUBE_STATIC_OVERRIDES <<< "${KUBE_STATIC_OVERRIDES:-}"
+readonly KUBE_STATIC_OVERRIDES
+
 kube::golang::is_statically_linked_library() {
   local e
+  if [[ -n "${KUBE_CGO_OVERRIDES:+x}" ]]; then
+    for e in "${KUBE_CGO_OVERRIDES[@]}"; do [[ "$1" == *"/$e" ]] && return 1; done;
+  fi
   for e in "${KUBE_STATIC_LIBRARIES[@]}"; do [[ "$1" == *"/$e" ]] && return 0; done;
-  # Allow individual overrides--e.g., so that you can get a static build of
-  # kubectl for inclusion in a container.
-  if [ -n "${KUBE_STATIC_OVERRIDES:+x}" ]; then
+  if [[ -n "${KUBE_STATIC_OVERRIDES:+x}" ]]; then
     for e in "${KUBE_STATIC_OVERRIDES[@]}"; do [[ "$1" == *"/$e" ]] && return 0; done;
   fi
   return 1;