diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1b103ee..0bd763f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -125,8 +125,12 @@ jobs:
             TLS_CFLAGS="-I$GITHUB_WORKSPACE/openssl-static/include" \
             TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a $EXTRA_STATIC_LIBS"
           file "dist/fossbench-${{ matrix.target }}"
-          if ! file "dist/fossbench-${{ matrix.target }}" | grep -q 'statically linked'; then
-            echo 'Linux release is dynamically linked' >&2
+          if ! file "dist/fossbench-${{ matrix.target }}" | grep -q 'dynamically linked'; then
+            echo 'Linux release uses static glibc, which is unsafe with NSS-based DNS' >&2
+            exit 1
+          fi
+          if readelf -d "dist/fossbench-${{ matrix.target }}" | grep -E 'NEEDED.*lib(ssl|crypto)'; then
+            echo 'Linux release uses dynamic OpenSSL' >&2
             exit 1
           fi
           if [ "${{ matrix.target }}" != linux-ppc32be ]; then
diff --git a/Makefile b/Makefile
index e6e61fa..317f852 100644
--- a/Makefile
+++ b/Makefile
@@ -118,23 +118,23 @@ windows-amd64: $(DIST)/fossbench-windows-amd64.exe
 windows-i386: $(DIST)/fossbench-windows-i386.exe
 
 $(DIST)/fossbench-linux-arm64: $(DRIVER) $(ASM_ARM64) | $(DIST)
-	$(CC_ARM64) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) -static $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS)
+	$(CC_ARM64) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossbench-linux-amd64: $(DRIVER) $(ASM_AMD64) | $(DIST)
-	$(CC_AMD64) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) -static $(LDFLAGS) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS)
+	$(CC_AMD64) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossbench-linux-i386: $(DRIVER) $(ASM_I386) | $(DIST)
-	$(CC_I386) -m32 -march=pentium4 -fno-pie -no-pie $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) -static $(LDFLAGS) -o $@ $(DRIVER) $(ASM_I386) $(LDLIBS)
+	$(CC_I386) -m32 -march=pentium4 -fno-pie -no-pie $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_I386) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossbench-linux-ppc32be: $(DRIVER) $(ASM_PPC32) | $(DIST)
-	$(CC_PPC32BE) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) -static $(LDFLAGS) -o $@ $(DRIVER) $(ASM_PPC32) $(LDLIBS)
+	$(CC_PPC32BE) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_PPC32) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossbench-linux-ppc64be: $(DRIVER) $(ASM_PPC64) | $(DIST)
-	$(CC_PPC64BE) -mcpu=970 -maltivec $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) -static $(LDFLAGS) -o $@ $(DRIVER) $(ASM_PPC64) $(LDLIBS)
+	$(CC_PPC64BE) -mcpu=970 -maltivec $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_PPC64) $(LDLIBS)
 	@echo "built $@"
 
 $(DIST)/fossbench-macos-arm64: $(DRIVER) $(ASM_ARM64) | $(DIST)
diff --git a/src/app/benchmark.c b/src/app/benchmark.c
index 2e482a1..3c5c66a 100644
--- a/src/app/benchmark.c
+++ b/src/app/benchmark.c
@@ -157,8 +157,12 @@ extern uint64_t fb_chase(void **ptrs, uint64_t steps);
 #  define CHASE_DETAIL	"dependent-load pointer chase, 16 MiB"
 #endif
 
-#define MIN_SECONDS	2.0			/* Minimum run time. */
-#define REPEATS		3			/* Number of tries. */
+#ifndef MIN_SECONDS
+#  define MIN_SECONDS	2.0			/* Minimum run time. */
+#endif
+#ifndef REPEATS
+#  define REPEATS	3			/* Number of tries. */
+#endif
 
 /* Numbers used to calculate scores. */