diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b665839..e38b22e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -86,7 +86,7 @@ jobs:
           make -j3 build_sw
           make install_sw
 
-      - name: Build static Linux executable
+      - name: Build Linux executable with static OpenSSL
         if: startsWith(matrix.target, 'linux-')
         run: |
           OPENSSL_LIBDIR="$(find "$GITHUB_WORKSPACE/openssl-static" -type f -name libssl.a -exec dirname {} \;)"
@@ -96,11 +96,10 @@ jobs:
           fi
           make "${{ matrix.target }}" \
             TLS_CFLAGS="-I$GITHUB_WORKSPACE/openssl-static/include" \
-            TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a $EXTRA_STATIC_LIBS" \
-            LDFLAGS=-static
+            TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a $EXTRA_STATIC_LIBS"
           file "dist/fossmark-${{ matrix.target }}"
-          if ldd "dist/fossmark-${{ matrix.target }}" 2>&1 | grep -q '=>'; then
-            echo 'Linux release binary is dynamically linked' >&2
+          if ldd "dist/fossmark-${{ matrix.target }}" | grep -E 'lib(ssl|crypto)'; then
+            echo 'Linux release uses dynamic OpenSSL' >&2
             exit 1
           fi
 
diff --git a/README.md b/README.md
index 4b6840c..85a480c 100644
--- a/README.md
+++ b/README.md
@@ -109,9 +109,11 @@ libc requires POWER6 instructions and produces release binaries that fault on
 the iMac G5's PowerPC 970. Build `linux-ppc64be` natively on the G5 so it uses
 the compatible Arch POWER ELFv2 runtime.
 
-Release binaries statically include OpenSSL. Linux releases are fully static;
-macOS releases retain only Apple's required system-library linkage because the
-macOS toolchain does not support fully static executables.
+Release binaries statically include OpenSSL. Linux releases dynamically use
+the system C library so DNS resolution can safely load the matching NSS
+modules; they do not require system OpenSSL libraries. macOS releases retain
+only Apple's required system-library linkage because the macOS toolchain does
+not support fully static executables.
 
 ## Continuous integration and releases
 
diff --git a/src/main.c b/src/main.c
index 8182dc4..88e8bd4 100644
--- a/src/main.c
+++ b/src/main.c
@@ -42,7 +42,7 @@
 #ifndef FM_API_BASE_URL
 #  define FM_API_BASE_URL "https://fossbench.net"
 #endif
-#define FM_VERSION "0.1.3-hotfix2"
+#define FM_VERSION "0.1.3-hotfix3"
 
 /* ---------- platform identification (for the banner only) ---------- */