diff --git a/.github/workflows/release-linux.yml b/.github/workflows/release-linux.yml
index 6015a6897..b678fd62b 100644
--- a/.github/workflows/release-linux.yml
+++ b/.github/workflows/release-linux.yml
@@ -25,6 +25,10 @@ permissions:
 env:
   CARGO_INCREMENTAL: 0
   CARGO_PROFILE_DEV_DEBUG: line-tables-only
+  # Jammy's default gcc is 11 (see the apt step); point every C/C++ compile
+  # at gcc-12 instead. Respected by cc-rs, cmake and autotools alike.
+  CC: gcc-12
+  CXX: g++-12
   # sccache, as in ci.yml (which explains why it sits alongside rust-cache).
   # Workflow-wide is safe here, unlike ci.yml: the one job installs sccache
   # before anything runs cargo, and the Arch package's `docker run` does not
@@ -44,7 +48,12 @@ env:
 jobs:
   build-linux:
     name: Build Linux Packages
-    runs-on: ubuntu-latest
+    # Pinned to 22.04 (glibc 2.35), NOT ubuntu-latest: glibc is backward-
+    # compatible only, so a binary built on 24.04 (glibc 2.39) refuses to
+    # start on 22.04-based distros (Pop!_OS 22.04, Mint 21, ...). Building on
+    # the oldest supported Ubuntu keeps the release runnable everywhere newer.
+    # Do not float this forward without also moving the glibc baseline check.
+    runs-on: ubuntu-22.04
 
     steps:
       - name: Checkout repository
@@ -87,6 +96,11 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y \
             pkg-config \
+            # Jammy's default gcc is 11, which cannot compile numkong's
+            # AVX512-FP16 kernels (`avx512fp16` target attribute needs GCC
+            # 12+). The 22.04 image carries gcc-12, so CC/CXX point at it.
+            gcc-12 \
+            g++-12 \
             libssl-dev \
             libwebkit2gtk-4.1-dev \
             libgtk-3-dev \
@@ -186,6 +200,20 @@ jobs:
           echo "Found atlas binary at: ${BIN_PATH}"
           echo "bin_path=${BIN_PATH}" >> "$GITHUB_OUTPUT"
 
+      # Regression guard for the 22.04 pin above: fail the job if the binary
+      # ever requires a glibc newer than the 22.04 baseline (2.35), e.g.
+      # because the runner label floated forward again.
+      - name: Check glibc baseline (must stay runnable on Ubuntu 22.04)
+        env:
+          ATLAS_BIN: ${{ steps.find_bin.outputs.bin_path }}
+        run: |
+          REQ=$(objdump -T "$ATLAS_BIN" | grep -o 'GLIBC_[0-9.]*' | sort -uV | tail -n 1)
+          echo "Highest required glibc symbol version: ${REQ:-none}"
+          if [ "$(printf '%s\n%s\n' "${REQ:-GLIBC_2.0}" GLIBC_2.35 | sort -V | tail -n 1)" != "GLIBC_2.35" ]; then
+            echo "::error::Binary requires ${REQ} but the Ubuntu 22.04 baseline is GLIBC_2.35"
+            exit 1
+          fi
+
       - name: Generate standalone tarball, licenses, icons & AUR PKGBUILD
         env:
           ATLAS_BIN: ${{ steps.find_bin.outputs.bin_path }}