diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 0000000..afa0225
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,27 @@
+# Build flags for the linux_amd64_musl extension build. These MUST live in cargo
+# config (not corrosion's RUSTFLAGS env), for two reasons:
+#
+#  1. Host build scripts. In the Alpine/musl image the host is
+#     x86_64-unknown-linux-musl, so build scripts compile for that triple. Rust
+#     defaults `crt-static = on` for musl, producing a *static* build-script
+#     binary. The `custom-labels` crate (a mandatory dep of vortex-duckdb /
+#     vortex-io) runs bindgen in its build script, and bindgen dlopen()s
+#     libclang — impossible from a static binary:
+#         Unable to find libclang: "... libclang.so ... could not be opened:
+#         Dynamic loading not supported"
+#     Under `--target`, env RUSTFLAGS only affects the target artifacts, not host
+#     build scripts. A `[target.<triple>]` config table, by contrast, also
+#     applies to host build scripts of that triple (target-applies-to-host,
+#     default true) — so disabling crt-static here makes them dynamically linked
+#     and able to dlopen libclang.
+#
+#  2. Relocation. The vortex crate is built as a staticlib folded into the
+#     loadable extension shared object; musl's default non-PIC codegen fails with
+#     "relocation R_X86_64_32 ... cannot be used when making a shared object".
+#     -Crelocation-model=pic fixes that for the target crate.
+#
+# Setting RUSTFLAGS env (as corrosion does) would make cargo IGNORE this table,
+# so the flags are kept here instead. Only consulted when building for the musl
+# triple, so glibc/macOS/Windows builds are unaffected.
+[target.x86_64-unknown-linux-musl]
+rustflags = ["-C", "target-feature=-crt-static", "-C", "relocation-model=pic"]
diff --git a/.github/workflows/MainDistributionPipeline.yml b/.github/workflows/MainDistributionPipeline.yml
index 158ad6a..dc4d065 100644
--- a/.github/workflows/MainDistributionPipeline.yml
+++ b/.github/workflows/MainDistributionPipeline.yml
@@ -19,5 +19,8 @@ jobs:
       ci_tools_version: v1.5.3
       duckdb_version: v1.5.3
       extension_name: vortex
-      exclude_archs: "wasm_mvp;wasm_eh;wasm_threads;windows_amd64_rtools;windows_amd64_mingw;windows_amd64;linux_amd64_musl"
+      exclude_archs: "wasm_mvp;wasm_eh;wasm_threads;windows_amd64_rtools;windows_amd64_mingw;windows_amd64"
+      # linux_amd64_musl is opt_in in extension-ci-tools' distribution_matrix.json,
+      # so removing it from exclude_archs is not enough — it must also be opted in here.
+      opt_in_archs: "linux_amd64_musl"
       extra_toolchains: "rust"
diff --git a/CMakeLists.txt b/CMakeLists.txt
index b2206b0..4558401 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -80,6 +80,13 @@ corrosion_set_env_vars(
     "DUCKDB_VERSION=${DUCKDB_VERSION}"
 )
 
+# NOTE: musl (Alpine) build flags live in .cargo/config.toml under
+# [target.x86_64-unknown-linux-musl], NOT here. They must be applied via cargo
+# config rather than corrosion's RUSTFLAGS env, because (a) under --target, env
+# RUSTFLAGS only reaches the target artifacts, not the *host* build scripts, and
+# the custom-labels build script needs a dynamic CRT to dlopen libclang; and
+# (b) setting RUSTFLAGS env makes cargo ignore the [target] config entirely.
+
 include_directories(src/include vortex/vortex-duckdb/include)
 
 set(EXTENSION_NAME ${TARGET_NAME}_extension)